# Copyright (C) 2013-2015 Ragpicker Developers.
# This file is part of Ragpicker Malware Crawler - http://code.google.com/p/malware-crawler/

import os
import string


RAGPICKER_VERSION = '0.06.00'
RAGPICKER_BUILD_DATE = '19.05.2014 06:00'
RAGPICKER_ROOT = os.path.normpath(os.path.join(os.path.abspath(os.path.dirname(__file__)), ".."))
PRINTABLE_CHARACTERS = string.letters + string.digits + string.punctuation + " "
PERMITTED_TYPES = ['Composite', 'Rich', 'PDF', 'Zip', 'RAR', 'PE32', 'MS-DOS']

# legit entry point sections
GOOD_EP_SECTIONS = ['.text', '.code', 'CODE', 'INIT', 'PAGE']

ANTI_DBGS = ['RaiseException', 'IsProcessorFeaturePresent', 'IsDebuggerPresent', 'CheckRemoteDebuggerPresent', 
             'GetTickCount', 'GetWindowThreadProcessId', 'OutputDebugString', 'TerminateProcess', 
             'UnhandledExceptionFilter', 'FindWindow', 'IsDebuggerPresent','Process32First', 'Process32Next', 
             'TerminateProcess', 'ZwQueryInformation', 'KdDebuggerEnabled']

VM_SIGN = {
    "Red Pill":"\x0f\x01\x0d\x00\x00\x00\x00\xc3",
    "VirtualPc trick":"\x0f\x3f\x07\x0b",
    "VMware trick":"VMXh",
    "VMCheck.dll":"\x45\xC7\x00\x01",
    "VMCheck.dll for VirtualPC":"\x0f\x3f\x07\x0b\xc7\x45\xfc\xff\xff\xff\xff",
    "Xen":"XenVMM",
    "Bochs & QEmu CPUID Trick":"\x44\x4d\x41\x63",
    "Torpig VMM Trick": "\xE8\xED\xFF\xFF\xFF\x25\x00\x00\x00\xFF\x33\xC9\x3D\x00\x00\x00\x80\x0F\x95\xC1\x8B\xC1\xC3",
    "Torpig (UPX) VMM Trick": "\x51\x51\x0F\x01\x27\x00\xC1\xFB\xB5\xD5\x35\x02\xE2\xC3\xD1\x66\x25\x32\xBD\x83\x7F\xB7\x4E\x3D\x06\x80\x0F\x95\xC1\x8B\xC1\xC3"
    }

BLACKLIST_API_FUNCTIONS = [
'IMPQueryIMEW', 'SetMessageWaitingIndicator', 'RegisterLogonProcess', 'SetDeskWallpaper', 'SetProgmanWindow', 
'SetLogonNotifyWindow', 'SetTaskmanWindow', 'SendIMEMessageEx', 'SendIMEMessage', 'AnyPopup', 'SetClipboardViewer', 
'NTPTimeToNTFileTime', 'GetExtendedUdpTable', 'GetExtendedTcpTable', 'AllocateAndGetUdpExTable2FromStack', 
'AllocateAndGetTcpExTable2FromStack', 'ConnectToConnectionPoint', 'CreateStatusWindow', 'GetPrivateProfileSection', 'GetPrivateProfileStruct', 
'GetProfileSection', 'GetProfileString', 'GlobalFree', 'GlobalHandle', 'GlobalReAlloc', 'IoFlushAdapterBuffers', 
'IoFreeAdapterChannel', 'IoFreeMapRegisters', 'IoMapTransfer', 'IoQueryDeviceDescription', 'IoReportResourceUsage', 
'IoUnregisterPlugPlayNotification', 'IsLoggingEnabled', 'IsNetDrive', 'LocalAlloc', 'LocalFree', 'LocalReAlloc', 
'MapDebugInformation', 'memcpy', 'memmove', 'NtClose', 'NtDeviceIoControlFile', 'NtWaitForSingleObject', 'OpenFile', 
'PassportWizardRunDll', 'PerUserInit', 'RegEnumKey', 'RegOpenKey', 'RegQueryValue', 'RegSetValue', 
'SHChangeProductKeyAsIDList', 'SHChangeUpdateImageIDList', 'SHCreateDirectory', 'SHCreateDirectoryEx', 
'SHCreateProcessAsUserW', 'Shell_GetCachedImageIndex', 'Shell_GetImageLists', 'Shell_MergeMenus', 'ShellMessageBox', 
'SHFlushClipboard', 'SHGetMalloc', 'UnMapDebugInformation', 'WriteHitLogging', 'WritePrivateProfileStruct', 
'SSL_SESSION_print', 'RC2_cbc_encrypt', 'RC2_cfb64_encrypt', 'RC2_ecb_encrypt', 'RC2_encrypt', 'RC2_ofb64_encrypt', 
'RC2_set_key', 'RC4', 'RC4_options', 'RC4_set_key', 'RSAPrivateKey_asn1_meth', 'DES_cfb64_encrypt', 'DES_cfb_encrypt', 
'DES_decrypt3', 'DES_ecb3_encrypt', 'DES_ecb_encrypt', 'DES_ede3_cbc_encrypt', 'DES_ede3_cfb64_encrypt', 
'DES_ede3_ofb64_encrypt', 'DES_enc_read', 'DES_enc_write', 'DES_encrypt1', 'DES_set_odd_parity', 'GlobalFix', 
'GlobalAlloc', 'GlobalFlags', 'GlobalUnlock', 'GlobalLock', 

'__p__commode', '__setusermatherr', '__WSAFDIsSet', '_crt_debugger_hook', '_execlpe', '_execve', 
'_FTP_Command', '_INetSmtpMail', '_invoke_watson', '_NWLogonQueryAdmin', '_NWLogonSetAdmin', 
'_PfAddFiltersToInterface@24', '_PfCreateInterface@24', '_PfDeleteInterface@4', '_PfUnBindInterface@4', 
'_resetstkoflw', '_setjmp3', '_TrackMouseEvent', '_viExecCommand', '_wexecve', '_wgetenv', 
'_WinAPI_BroadcastSystemMessage', '_WinAPI_SendMessageTimeout', '_WinStationAnnoyancePopup', 
'_WinStationBeepOpen', '_WinStationBreakPoint', '_WinStationCallback', '_WinStationCheckForApplicationName', 
'_WinStationFUSCanRemoteUserDisconnect', '_WinStationGetApplicationInfo', '_WinStationNotifyDisconnectPipe', 
'_WinStationNotifyLogoff', '_WinStationNotifyLogon', '_WinStationNotifyNewSession', '_WinStationOpenSessionDirectory', 
'_WinStationReadRegistry', '_WinStationReInitializeSecurity', '_WinStationSessionInitialized', 
'_WinStationShadowTarget', '_WinStationShadowTarget2', '_WinStationShadowTargetSetup', 
'_WinStationUpdateClientCachedCredentials', '_WinStationUpdateSettings', 

'AbortSystemShutdown', 'accept', 'AccessCheck', 'AccessCheckAndAuditAlarm', 'AccessCheckByType', 
'AccessCheckByTypeAndAuditAlarm', 'AccessCheckByTypeResultList', 'AccessCheckByTypeResultListAndAuditAlarm', 
'AccessCheckByTypeResultListAndAuditAlarmByHandle', 'acmDriverAdd', 'acmDriverEnum', 'acmDriverOpen', 'acmStreamOpen', 
'AddAccessAllowedAce', 'AddAccessAllowedAceEx', 'AddAccessAllowedObjectAce', 'AddAccessDeniedAce', 
'AddAccessDeniedAceEx', 'AddAccessDeniedObjectAce', 'AddAce', 'AddAtom', 'AddAuditAccessAce', 'AddAuditAccessAceEx', 
'AddAuditAccessObjectAce', 'AddClipboardFormatListener', 'AddCommasExport', 'AddConditionalAce', 'AddConsoleAlias', 
'AddIPAddress', 'AddMandatoryAce', 'AddPrintProcessor', 'AddResourceAttributeAce', 'AddScopedPolicyIDAce', 
'AddVectoredExceptionHandler', 'AdjustTokenGroups', 'AdjustTokenPrivileges', 'AdjustTokenPrivileges', 
'AllocateAndGetIpAddrTableFromStack', 'AllocateAndInitializeSid', 'AllocateLocallyUniqueId', 'AllocateUserPhysicalPages', 
'AllocConsole', 'AllowForegroundActivation', 'AllowSetForegroundWindow', 'AppCompat_RunDLL', 'AppCompat_RunDLLW', 
'AreAllAccessesGranted', 'AreAnyAccessesGranted', 'ASN1BERDecBool', 'ASN1BERDecCharString', 'ASN1BERDecCheck', 'ASN1BERDecEoid', 
'ASN1BERDecNull', 'AssocCreate', 'AssocQueryString', 'AtlAxAttachControl', 'AtlAxCreateControl', 'AtlAxCreateControlEx', 
'AtlAxCreateControlLic', 'AtlAxCreateControlLicEx', 'AtlAxCreateDialog', 'AtlAxGetControl', 'AtlAxGetHost', 'AtlAxWinInit', 
'AtlAxWinTerm', 'AtlCallTermFunc', 'AtlComModuleRegisterClassObjects', 'AtlComModuleRevokeClassObjects', 'AtlCreateRegistrar', 
'AtlGetPerUserRegistration', 'AtlLoadTypeLib', 'AtlMarshalPtrInProc', 'AtlRegisterClassCategoriesHelper', 'AtlSetPerUserRegistration', 
'AtlUpdateRegistryFromResourceD', 'AttachConsole', 'AttachThreadInput', 'AU3_GetPluginDetails', 'AuditComputeEffectivePolicyBySid', 
'AuditComputeEffectivePolicyByToken', 'AuditEnumerateCategories', 'AuditEnumeratePerUserPolicy', 'AuditEnumerateSubCategories', 
'AuditFree', 'AuditLookupCategoryGuidFromCategoryId', 'AuditLookupCategoryIdFromCategoryGuid', 'AuditLookupCategoryName', 
'AuditLookupSubCategoryName', 'AuditQueryGlobalSacl', 'AuditQueryPerUserPolicy', 'AuditQuerySecurity', 'AuditQuerySystemPolicy', 
'AuditSetGlobalSacl', 'AuditSetPerUserPolicy', 'AuditSetSecurity', 'AuditSetSystemPolicy', 'AuthzAccessCheck', 
'AuthzAccessCheckCallback', 'AuthzAddSidsToContext', 'AuthzCachedAccessCheck', 'AuthzComputeGroupsCallback', 
'AuthzEnumerateSecurityEventSources', 'AuthzFreeAuditEvent', 'AuthzFreeCentralAccessPolicyCache', 'AuthzFreeCentralAccessPolicyCallback', 
'AuthzFreeContext', 'AuthzFreeGroupsCallback', 'AuthzFreeHandle', 'AuthzFreeResourceManager', 'AuthzGetCentralAccessPolicyCallback', 
'AuthzGetInformationFromContext', 'AuthzInitializeCompoundContext', 'AuthzInitializeContextFromAuthzContext', 'AuthzInitializeContextFromSid', 
'AuthzInitializeContextFromToken', 'AuthzInitializeObjectAccessAuditEvent', 'AuthzInitializeObjectAccessAuditEvent2', 
'AuthzInitializeRemoteResourceManager', 'AuthzInitializeResourceManager', 'AuthzInitializeResourceManagerEx', 
'AuthzInstallSecurityEventSource', 'AuthzModifyClaims', 'AuthzModifySecurityAttributes', 'AuthzModifySids', 
'AuthzOpenObjectAudit', 'AuthzRegisterCapChangeNotification', 'AuthzRegisterSecurityEventSource', 'AuthzReportSecurityEvent', 
'AuthzReportSecurityEventFromParams', 'AuthzSetAppContainerInformation', 'AuthzUninstallSecurityEventSource', 
'AuthzUnregisterCapChangeNotification', 'AuthzUnregisterSecurityEventSource', 'AutoDialFunc', 

'BackupEventLog', 'BackupEventLog', 'BackupRead', 'BackupSeek', 'BackupWrite', 'BaseFormatTimeOut', 'BaseGetNamedObjectDirectory', 
'BaseInitAppcompatCacheSupport', 'Basep8BitStringToDynamicUnicodeString', 'BaseQueryModuleData', 'BeginUpdateResource', 'bind', 'bind', 
'BindImage', 'BindImageEx', 'BlockInput', 'BMAPIAddress', 'BroadcastSystemMessage', 'BroadcastSystemMessageEx', 'BuildCommDCBAndTimeouts', 
'BuildExplicitAccessWithName', 'BuildImpersonateExplicitAccessWithName', 'BuildImpersonateTrustee', 'BuildSecurityDescriptor', 
'BuildTrusteeWithName', 'BuildTrusteeWithObjectsAndName', 'BuildTrusteeWithObjectsAndSid', 'BuildTrusteeWithSid', 

'CallMsgFilter', 'CallNamedPipe', 'CallNextHookEx', 'CallNtPowerInformation', 'CallWindowProc', 'CancelDeviceWakeupRequest', 'CanShareFolderW', 
'CanUserWritePwrScheme', 'capControlCallback', 'capCreateCaptureWindow', 'capErrorCallback', 'capGetDriverDescription', 'capStatusCallback',
'capVideoStreamCallback', 'capWaveStreamCallback', 'capYieldCallback', 'CDaoDatabase::GetConnect', 'CDaoDatabase::GetConnect', 
'CDaoQueryDef::Execute', 'CDaoQueryDef::Execute', 'CDatabase::GetConnectInfo', 'CDatabase::GetConnectInfo', 'CeipIsOptedIn', 'CertConfigureTrustA',
'CertOpenSystemStore', 'CertTrustCertPolicy', 'CertTrustInit', 'CException::Delete', 'CException::Delete', 'CFile::CreateControl', 'CFile::CreateControl', 
'CGopherFileFind::GetLastWriteTime', 'CGopherFileFind::GetLastWriteTime', 'ChangeClipboardChain', 'ChangeServiceConfig', 'ChangeServiceConfig2',
'ChangeWindowMessageFilter', 'CheckElevationEnabled', 'CheckMemoryGates', 'CheckRemoteDebuggerPresent', 'CheckStagingArea', 'CheckSumMappedFile', 
'CheckSumMappedFile', 'CheckTokenCapability', 'CheckTokenMembership', 'CheckTokenMembership', 'CheckTokenMembershipEx', 'CICreateCommand', 'ClearEventLog', 
'ClientThreadSetup', 'CloseClipboard', 'CloseConsoleHandle', 'CloseDesktop', 'CloseEncryptedFileRaw', 'CloseEventLog', 'CloseODBCPerfData', 
'CloseODBCPerfData', 'ClosePopupTipbar', 'CloseServiceHandle', 'closesocket', 'CloseTrace', 'CloseWindowStation', 'CLRCreateInstance', 'CLSIDFromString', 
'CmCustomDialDlg', 'CmReConnect', 'CoAddRefServerProcess', 'CoCreateGuid', 'CoCreateInstance', 'CoCreateInstanceEx', 'CoFileTimeNow', 'CoFreeUnusedLibraries', 
'CoGetClassObject', 'CoGetCurrentProcess', 'CoGetInstanceFromFile', 'CoInitialize', 'CoInitializeEx', 'CoInitializeSecurity', 'CoInternetCreateSecurityManager', 
'CoInternetCreateZoneManager', 'CoIsOle1Class', 'COleControl::OnCreate', 'COleControl::OnCreate', 'CollectODBCPerfData', 'CollectODBCPerfData', 
'CoLoadLibrary', 'CommandLineToArgv', 'commands', 'CommConfigDialog', 'CompareFileTime', 'connect', 'connect', 'ConnectNamedPipe', 'ConsoleMenuControl', 
'ConsoleSubst', 'ContinueDebugEvent', 'Control_RunDLL', 'Control_RunDLLA', 'Control_RunDLLAsUserW', 'Control_RunDLLW', 'ControlSend', 'ControlService', 
'ControlTrace', 'ConvertAccessToSecurityDescriptor', 'ConvertSecurityDescriptorToAccess', 'ConvertSecurityDescriptorToAccessNamed', 
'ConvertSecurityDescriptorToStringSecurityDescriptor', 'ConvertSecurityDescriptorToStringSecurityDescriptor', 'ConvertSidToStringSid', 
'ConvertSidToStringSid', 'ConvertStringSDToSDRootDomain', 'ConvertStringSecurityDescriptorToSecurityDescriptor', 
'ConvertStringSecurityDescriptorToSecurityDescriptor', 'ConvertStringSidToSid', 'ConvertThreadToFiber', 'ConvertToAutoInheritPrivateObjectSecurity', 
'CopyFile', 'CopyFileEx', 'CopyImage', 'CopyLZFile', 'CopyLZFile', 'CopySid', 'CoQueryClientBlanket', 'CorBindToRuntime', 'CorBindToRuntimeEx', 
'CoRegisterChannelHook', 'CoReleaseServerProcess', 'CoSetProxyBlanket', 'CoUninitialize', 'CoUninitializeEx', 'CountClipboardFormats', 'CreateAutoListParser', 
'CreateDesktop', 'CreateDesktopEx', 'CreateDirectory', 'CreateDirectory', 'CreateDirectoryEx', 'CreateEnvironmentBlock', 'CreateEvent', 'CreateFiberEx', 
'CreateFile', 'CreateFileMapping', 'CreateHardLink', 'CreateHardwareEventMoniker', 'CreateInfoTipFromItem', 'CreateInfoTipFromItem2', 'CreateIpNetEntry', 
'CreateMailslot', 'CreateMutex', 'CreateNamedPipe', 'CreatePipe', 'CreatePrivateObjectSecurity', 'CreatePrivateObjectSecurityEx', 
'CreatePrivateObjectSecurityWithMultipleInheritance', 'CreateProcess', 'CreateProcessAsUser', 'CreateProcessWithLogon', 'CreateProfile', 'CreateRemoteThread', 
'CreateRestrictedToken', 'CreateSecurityPage', 'CreateSemaphore', 'CreateService', 'CreateService', 'CreateSymbolicLink', 'CreateSymbolicLinkTransacted', 
'CreateTapePartition', 'CreateThread', 'CreateThreadpool', 'CreateThreadpoolCleanupGroup', 'CreateThreadpoolIo', 'CreateThreadpoolTimer', 'CreateThreadpoolWait', 
'CreateThreadpoolWork', 'CreateToolhelp32Snapshot', 'CreateTypeLib', 'CreateURLMoniker', 'CreateURLMonikerEx', 'CreateUserProfileEx', 'CreateWellKnownSid', 
'CreateWindowStation', 'CredDelete', 'CredEnumerate', 'CredFindBestCredential', 'CredFree', 'CredGetSessionTypes', 'CredGetTargetInfo', 
'CredIsMarshaledCredential', 'CredIsProtected', 'CredMarshalCredential', 'CredPackAuthenticationBuffer', 'CredProtect', 'CredRead', 'CredReadDomainCredentials', 
'CredRename', 'CredUICmdLinePromptForCredentials', 'CredUIPromptForCredentials', 'CredUnmarshalCredential', 'CredUnPackAuthenticationBuffer', 
'CredUnPackAuthenticationBuffer', 'CredUnprotect', 'CredWrite', 'CredWriteDomainCredentials', 'CryptAcquireContext', 'CryptCreateHash', 'CryptDecrypt', 
'CryptDeriveKey', 'CryptDestroyHash', 'CryptDestroyKey', 'CryptDuplicateHash', 'CryptEncrypt', 'CryptEnumProviders', 'CryptEnumProviderTypes', 'CryptExportKey', 
'CryptGenKey', 'CryptGenRandom', 'CryptGetDefaultProvider', 'CryptGetHashParam', 'CryptGetKeyParam', 'CryptGetUserKey', 'CryptHashData', 'CryptImportKey', 
'CryptReleaseContext', 'CryptSetHashParam', 'CryptSetKeyParam', 'CryptSetProviderEx', 'CryptSetProvParam', 'CryptSignHash', 'CryptVerifySignature', 
'CscSearchApiGetInterface', 'CSocket::ProcessAuxQueue', 'CSocket::ProcessAuxQueue', 'CWinThread::Delete', 'CWinThread::ProcessWndProcException', 
'CWinThread::ProcessWndProcException', 

'D3DKMTAcquireKeyedMutex', 'D3DKMTCheckExclusiveOwnership', 'D3DKMTCheckMonitorPowerState', 'D3DKMTCheckOcclusion', 'D3DKMTCheckSharedResourceAccess', 
'D3DKMTCheckVidPnExclusiveOwnership', 'D3DKMTCloseAdapter', 'D3DKMTConfigureSharedResource', 'D3DKMTCreateAllocation', 'D3DKMTCreateAllocation2', 
'D3DKMTCreateContext', 'D3DKMTCreateDCFromMemory', 'D3DKMTCreateDevice', 'D3DKMTCreateKeyedMutex', 'D3DKMTCreateOverlay', 'D3DKMTCreateSynchronizationObject', 
'D3DKMTCreateSynchronizationObject2', 'D3DKMTDestroyAllocation', 'D3DKMTDestroyContext', 'D3DKMTDestroyDCFromMemory', 'D3DKMTDestroyDevice', 
'D3DKMTDestroyKeyedMutex', 'D3DKMTDestroyOverlay', 'D3DKMTDestroySynchronizationObject', 'D3DKMTEscape', 'D3DKMTFlipOverlay', 'D3DKMTGetContextSchedulingPriority', 
'D3DKMTGetDeviceState', 'D3DKMTGetDisplayModeList', 'D3DKMTGetMultisampleMethodList', 'D3DKMTGetOverlayState', 'D3DKMTGetPresentHistory', 
'D3DKMTGetPresentQueueEvent', 'D3DKMTGetProcessSchedulingPriorityClass', 'D3DKMTGetRuntimeData', 'D3DKMTGetScanLine', 'D3DKMTGetSharedPrimaryHandle', 
'D3DKMTInvalidateActiveVidPn', 'D3DKMTLock', 'D3DKMTOpenAdapterFromDeviceName', 'D3DKMTOpenAdapterFromGdiDisplayName', 'D3DKMTOpenAdapterFromHdc', 
'D3DKMTOpenKeyedMutex', 'D3DKMTOpenResource', 'D3DKMTOpenResource2', 'D3DKMTOpenSynchronizationObject', 'D3DKMTPollDisplayChildren', 'D3DKMTPresent', 
'D3DKMTQueryAdapterInfo', 'D3DKMTQueryAllocationResidency', 'D3DKMTQueryResourceInfo', 'D3DKMTQueryStatistics', 'D3DKMTReleaseKeyedMutex', 
'D3DKMTReleaseProcessVidPnSourceOwners', 'D3DKMTRender', 'D3DKMTSetAllocationPriority', 'D3DKMTSetContextSchedulingPriority', 'D3DKMTSetDisplayMode', 
'D3DKMTSetDisplayPrivateDriverFormat', 'D3DKMTSetGammaRamp', 'D3DKMTSetProcessSchedulingPriorityClass', 'D3DKMTSetQueuedLimit', 'D3DKMTSetVidPnSourceOwner', 
'D3DKMTSharedPrimaryLockNotification', 'D3DKMTSharedPrimaryUnLockNotification', 'D3DKMTSignalSynchronizationObject', 'D3DKMTSignalSynchronizationObject2', 
'D3DKMTUnlock', 'D3DKMTUpdateOverlay', 'D3DKMTWaitForIdle', 'D3DKMTWaitForSynchronizationObject', 'D3DKMTWaitForSynchronizationObject2', 
'D3DKMTWaitForVerticalBlankEvent', 'DbgPrint', 'DbgPrint', 'DbgPrintEx', 'DdeClientTransaction', 'DdeConnect', 'DdeCreateDataHandle', 'DdeCreateStringHandle', 
'DdeDisconnect', 'DdeFreeDataHandle', 'DdeFreeStringHandle', 'DdeGetData', 'DdeGetLastError', 'DdeInitialize', 'DdeNameService', 'DdePostAdvise', 
'DdeQueryNextServer', 'DdeQueryString', 'DdeSetQualityOfService', 'DdeUninitialize', 'DebugActiveProcess', 'DebugBreak', 'DecodePointer', 'DecryptFile', 
'DecryptMessage', 'DefineDosDevice', 'DelayLoadFailureHook', 'DeleteAce', 'DeleteAtom', 'DeleteExtractedFiles', 'DeleteFiber', 'DeleteFile', 'DeleteIpAddress', 
'DeleteIpForwardEntry', 'DeleteIpForwardEntry2', 'DeleteIpNetEntry', 'DeleteIpNetEntry2', 'DeletePort', 'DeletePort', 'DeletePrinter', 'DeletePrinterConnection', 
'DeletePrintProcessor', 'DeleteProfile', 'DeletePwrScheme', 'DeleteSecurityContext', 'DeleteService', 'DeleteUrlCacheEntry', 'DeleteVolumeMountPoint', 
'DeltaNotify', 'DeregisterEventSource', 'DeregisterEventSource', 'DeregisterShellHookWindow', 'DesktopHasWatermarkText', 'DestroyEnvironmentBlock', 
'DestroyPrivateObjectSecurity', 'DeviceCreateHardwarePage', 'DeviceIoControl', 'DevicePowerClose', 'DevicePowerEnumDevices', 'DevicePowerOpen', 
'DevicePowerSetDeviceState', 'DeviceProblemText', 'DeviceProblemWizard', 'DeviceProperties', 'DirectSoundCaptureCreate', 'DirectSoundCaptureCreate8', 
'DirectSoundCaptureEnumerate', 'DirectSoundCaptureEnumerate', 'DirectSoundCreate', 'DirectSoundCreate8', 'DirectSoundEnumerate', 'DirectSoundEnumerate', 
'DirectSoundFullDuplexCreate', 'DisableThreadLibraryCalls', 'DisconnectNamedPipe', 'DisconnectWindowsDialog', 'DispatchMessage', 'DllBidEntryPoint', 
'DllCanUnloadNow', 'DllCanUnloadNow', 'DllFunctionCall', 'DllGetClassObject', 'DllGetClassObject', 'DllGetVersion', 'DllGetVersion', 'DllInitialize', 
'DllInstall', 'DllInstall', 'DllRegisterServer', 'DllRegisterServer', 'DllRegisterServer', 'DllRegisterServer', 'DllUnregisterServer', 'DllUnregisterServer', 
'DllUnregisterServer', 'DnsAcquireContextHandle', 'DnsCancelQuery', 'DnsExtractRecordsFromMessage', 'DnsFree', 'DnsFreeProxyName', 'DnsGetProxyInformation', 
'DnsHostnameToComputerName', 'DnsModifyRecordsInSet', 'DnsNameCompare', 'DnsQuery_', 'DnsQuery_', 'DnsQueryConfig', 'DnsQueryEx', 'DnsQueryEx', 'DnsRecordCompare', 
'DnsRecordCopyEx', 'DnsRecordListFree', 'DnsRecordSetCompare', 'DnsRecordSetCopyEx', 'DnsRecordSetDetach', 'DnsReleaseContextHandle', 'DnsReplaceRecordSet', 
'DnsValidateName', 'DnsValidateServerStatus', 'DnsWriteQuestionToBuffer', 'do_echo_req', 'DoEnvironmentSubstA', 'DoEnvironmentSubstW', 'DownloadRunExeId', 
'DownloadRunExeUrl', 'DownloadRunModId', 'DownloadUpdateMain', 'DsBind', 'DsCrackSpn', 'DSCreateISecurityInfoObject', 'DSCreateISecurityInfoObjectEx', 
'DSCreateSecurityPage', 'DSEditSecurity', 'DsFreeDomainControllerInfo', 'DsFreeNameResult', 'DsFreePasswordCredentials', 'DsFreeSchemaGuidMap', 
'DsGetDomainControllerInfo', 'DsListSites', 'DsMakeSpn', 'DsMapSchemaGuids', 'DsQuoteRdnValue', 'DsUnBind', 'DuplicateConsoleHandle', 
'DuplicateEncryptionInfoFile', 'DuplicateHandle', 'DuplicateToken', 'DuplicateTokenEx', 'DupWideToAnsi', 

'EditSecurity', 'EditSecurityAdvanced', 'ElfBackupEventLogFile', 'ElfChangeNotify', 'ElfClearEventLogFile', 'ElfCloseEventLog', 'ElfDeregisterEventSource', 
'ElfFlushEventLog', 'ElfNumberOfRecords', 'ElfOldestRecord', 'ElfOpenBackupEventLog', 'ElfOpenEventLog', 'ElfReadEventLog', 'ElfRegisterEventSource', 
'ElfReportEvent', 'ElfReportEventAndSource', 'EmptyClipboard', 'EmptyWorkingSet', 'EnableExecuteProtectionSupport', 'EncodePointer', 'EncryptFile', 
'EncryptMessage', 'EndUpdateResource', 'EngLoadModule', 'EnumCalendarInfo', 'EnumChildWindows', 'EnumClipboardFormats', 'EnumDependentServices', 'EnumDesktops', 
'EnumDesktopWindows', 'EnumDeviceDrivers', 'EnumDeviceDrivers', 'EnumDirTree', 'EnumDisplayDevices', 'EnumDisplayMonitors', 'EnumerateLoadedModules', 
'EnumerateLoadedModules', 'EnumerateLoadedModules64', 'EnumerateLoadedModulesEx', 'EnumerateLoadedModulesW64', 'EnumerateLoadedModulesW64', 'EnumMonitorsA', 
'EnumMonitorsW', 'EnumPageFiles', 'EnumPorts', 'EnumProcesses', 'EnumProcesses', 'EnumProcessModules', 'EnumProcessModules', 'EnumProcessModulesEx', 
'EnumPwrSchemes', 'EnumResourceLanguages', 'EnumResourceNames', 'EnumResourceTypes', 'EnumServiceGroup', 'EnumServicesStatus', 'EnumServicesStatusEx', 
'EnumSystemFirmwareTables', 'EnumThreadWindows', 'EnumThreadWindows', 'EnumWindows', 'EnumWindowStations', 'EqualDomainSid', 'EqualPrefixSid', 'EqualSid', 
'EraseTape', 'EraseTape', 'EtwEventEnabled', 'EtwEventRegister', 'EtwEventUnregister', 'EtwEventWrite', 'EtwGetTraceEnableFlags', 'EtwGetTraceEnableLevel', 
'EtwGetTraceLoggerHandle', 'EtwRegisterTraceGuids', 'EtwTraceMessage', 'EtwUnregisterTraceGuids', 'ExecWB', 'ExitProcess', 'ExitThread', 'ExitVDM', 
'ExitWindowsEx', 'ExpandEnvironmentStringsForUser', 'ExpungeConsoleCommandHistory', 'Extract', 

'FatalAppExit', 'FatalExit', 'FCIAddFile', 'FCICreate', 'FCIDestroy', 'FCIFlushCabinet', 'FCIFlushCabinet', 'FCIFlushFolder', 'FDICopy', 'FDICreate', 'FDIDestroy', 
'FDIIsCabinet', 'FDITruncateCabinet', 'FileRecycle', 'FillConsoleOutputCharacter', 'FindActCtxSectionString', 'FindAtom', 'FindClose', 
'FindCloseChangeNotification', 'FindCloseUrlCache', 'FindDebugInfoFile', 'FindDebugInfoFileEx', 'FindExecutable', 'FindExecutableA', 'FindExecutableImage', 
'FindExecutableImageEx', 'FindExecutableW', 'FindFileInPath', 'FindFileInSearchPath', 'FindFirstChangeNotification', 'FindFirstFile', 'FindFirstFileEx', 
'FindFirstFileName', 'FindFirstFileNameTransacted', 'FindFirstFileTransacted', 'FindFirstFreeAce', 'FindFirstStream', 'FindFirstUrlCacheContainer', 
'FindFirstUrlCacheEntry', 'FindFirstVolume', 'FindFirstVolumeMountPoint', 'FindNextChangeNotification', 'FindNextFile', 'FindNextFileName', 'FindNextStream', 
'FindNextUrlCacheContainer', 'FindNextUrlCacheEntry', 'FindNextVolume', 'FindNextVolumeMountPoint', 'FindResource', 'FindResourceEx', 'FindVolumeClose', 
'FindVolumeMountPointClose', 'FindWindow', 'FindWindowEx', 'FlushConsoleInputBuffer', 'FlushFileBuffers', 'FlushInstructionCache', 'FlushIpNetTable', 
'FlushProcessWriteBuffers', 'FlushTrace', 'FlushViewOfFile', 'ForceSyncFgPolicy', 'formgrabber', 'FreeConsole', 'FreeCryptProvFromCert', 'FreeCryptProvFromCertEx', 
'FreeDDElParam', 'FreeEnvironmentStrings', 'FreeGPOList', 'FreeInheritedFromArray', 'FreeLibrary', 'FreeLibraryAndExitThread', 'FreeLibraryWhenCallbackReturns', 
'FreeResource', 'FreeSid', 'FreeUserPhysicalPages', 'FrostCrashedWindow', 'FtpCommand', 'FtpCreateDirectory', 'FtpDeleteFile', 'FtpFindFirstFile', 
'FtpGetCurrentDirectory', 'FtpGetFile', 'FtpGetFileSize', 'FtpOpenFile', 'FtpPutFile', 'FtpRemoveDirectory', 'FtpRenameFile', 'FtpSetCurrentDirectory', 
'FveEnableRawAccess', 'fwrite', 

'GenerateConsoleCtrlEvent', 'GetAccessSecurityDescriptor', 'GetAce', 'GetAclInformation', 'GetActivePwrScheme', 'GetAdapterIndex', 'GetAdaptersAddresses', 
'GetAdaptersInfo', 'getaddrinfo', 'GetAllUsersProfileDirectory', 'GetAncestor', 'GetAppCompatFlags', 'GetAppCompatFlags2', 'GetAppContainerNamedObjectPath', 
'GetAppliedGPOList', 'GetAppPathFromLink', 'GetAsyncKeyState', 'GetAtomName', 'GetAuditedPermissionsFromAcl', 'GetAuditedPermissionsFromAcl', 
'GetAuditedPermissionsFromAcl', 'GetBestRoute', 'GetBinaryType', 'GetCalendarInfo', 'GetCapture', 'GetChildTipbar', 'GetClassLong', 'GetClipboardData', 
'GetClipboardFormatName', 'GetClipboardOwner', 'GetClipboardSequenceNumber', 'GetClipboardViewer', 'GetCommandLine', 'GetCommConfig', 'GetCommModemStatus', 
'GetCommProperties', 'GetCommTimeouts', 'GetCompressedFileSize', 'GetComputerName', 'GetComputerNameEx', 'GetConfigurationSecurityDescriptor', 'GetConsoleAlias', 
'GetConsoleAliases', 'GetConsoleAliasesLength', 'GetConsoleAliasExes', 'GetConsoleAliasExesLength', 'GetConsoleCommandHistory', 'GetConsoleCommandHistoryLength', 
'GetConsoleDisplayMode', 'GetConsoleFontInfo', 'GetConsoleFontSize', 'GetConsoleHardwareState', 'GetConsoleInputExeName', 'GetConsoleInputWaitHandle', 
'GetConsoleKeyboardLayoutName', 'GetConsoleScreenBufferInfo', 'GetConsoleTitle', 'GetConsoleWindow', 'GetCryptProvFromCert', 'GetCryptProvFromCertEx', 
'GetCurrentConsoleFont', 'GetCurrentHwProfile', 'GetCurrentPackageId', 'GetCurrentPowerPolicies', 'GetCurrentProcess', 'GetCurrentProcessExplicitAppUserModelID', 
'GetCurrentProcessId', 'GetCurrentProcessorNumber', 'GetCurrentProcessorNumberEx', 'GetCurrentThread', 'GetCurrentThreadId', 'GetDefaultCommConfig', 
'GetDesktopWindow', 'GetDeviceDriverBaseName', 'GetDeviceDriverBaseName', 'GetDeviceDriverBaseName', 'GetDeviceDriverFileName', 'GetDeviceID', 
'GetDevicePowerState', 'GetDiskFreeSpace', 'GetDiskFreeSpaceEx', 'GetDllVersion', 'GetDoubleClickTime', 'GetDriveType', 'GetEffectiveRightsFromAcl', 'getenv', 
'GetEnvironmentStrings', 'GetEnvironmentVariable', 'GetEventLogInformation', 'GetExitCodeProcess', 'GetExitCodeThread', 'GetExpandedName', 
'GetExplicitEntriesFromAcl', 'GetFileAttributes', 'GetFileInformationByHandle', 'GetFileInformationByHandleEx', 'GetFileSecurity', 'GetFileType', 
'GetFileVersionInfo', 'GetFileVersionInfoSize', 'GetFirmwareEnvironmentVariable', 'GetForegroundWindow', 'GetGeoInfo', 'GetGuiResources', 'GetGUIThreadInfo', 
'gethostbyname', 'gethostbyname', 'gethostname', 'gethostname', 'GetIcmpStatistics', 'GetIfEntry', 'GetIfTable', 'GetImageConfigInformation', 
'GetImageUnusedHeaderBytes', 'GetInheritanceSource', 'GetInputState', 'GetInternalWindowPos', 'GetIpAddrTable', 'GetIpNetTable', 'GetIpStatistics', 
'GetKernelObjectSecurity', 'GetKeyboardState', 'GetKeyState', 'GetLargestConsoleWindowSize', 'GetLastActivePopup', 'GetLastInputInfo', 'GetLengthSid', 
'GetLogicalDrives', 'GetLogicalDriveStrings', 'GetLogicalProcessorInformation', 'GetLogicalProcessorInformationEx', 'GetMailslotInfo', 'GetMappedFileName', 
'GetMappedFileName', 'GetMessageExtraInfo', 'GetMessagePos', 'GetMessageTime', 'GetModuleBaseName', 'GetModuleBaseName', 'GetModuleFileName', 'GetModuleFilename', 
'GetModuleFileNameEx', 'GetModuleHandle', 'GetModuleHandleEx', 'GetModuleInformation', 'GetModuleInformation', 'GetMonitorInfo', 'GetMultipleTrustee', 
'GetMultipleTrusteeOperation', 'GetNamedPipeHandleState', 'GetNamedPipeInfo', 'GetNamedSecurityInfo', 'GetNativeSystemInfo', 'GetNetResourceFromLocalPath', 
'GetNetworkParams', 'GetNumberOfConsoleFonts', 'GetNumberOfConsoleInputEvents', 'GetNumberOfEventLogRecords', 'GetNumberOfEventLogRecords', 'GetODBCSharedData', 
'GetODBCSharedData', 'GetOEMCP', 'GetOldestEventLogRecord', 'GetOldestEventLogRecord', 'GetOpenCardNameA', 'GetOpenCardNameW', 'GetOpenClipboardWindow', 
'GetOverlappedAccessResults', 'GetOverlappedResult', 'getpeername', 'GetPerformanceInfo', 'GetPhysicallyInstalledSystemMemory', 'GetPopupTipbar', 
'GetPrinterDriverDirectory', 'GetPrintProcessorDirectory', 'GetPriorityClass', 'GetPriorityClipboardFormat', 'GetPrivateObjectSecurity', 'GetPrivateProfileInt', 
'GetPrivateProfileSectionNames', 'GetPrivateProfileString', 'GetProcAddress', 'GetProcessAffinityMask', 'GetProcessDEPPolicy', 'GetProcessHeap', 'GetProcessId', 
'GetProcessImageFileName', 'GetProcessIoCounters', 'GetProcessMemoryInfo', 'GetProcessMemoryInfo', 'GetProcessMitigationPolicy', 'GetProcessShutdownParameters', 
'GetProcessTimes', 'GetProcessVersion', 'GetProcessWindowStation', 'GetProcessWorkingSetSize', 'GetProductInfo', 'GetProfileInt', 'GetProfilesDirectory', 
'GetProgmanWindow', 'GetPwrCapabilities', 'GetPwrDiskSpindownRange', 'GetQueueStatus', 'GetQueueStatus', 'GetReasonTitleFromReasonCode', 
'GetRegisteredRawInputDevices', 'GetRunningObjectTable', 'GetSecurityDescriptorControl', 'GetSecurityDescriptorDacl', 'GetSecurityDescriptorGroup', 
'GetSecurityDescriptorLength', 'GetSecurityDescriptorOwner', 'GetSecurityDescriptorRMControl', 'GetSecurityDescriptorSacl', 'GetSecurityInfo', 
'GetSendMessageReceiver', 'GetServiceKeyName', 'GetShellWindow', 'GetSidIdentifierAuthority', 'GetSidLengthRequired', 'GetSidSubAuthority', 
'GetSidSubAuthorityCount', 'getsockname', 'getsockopt', 'GetSqmableFileName', 'GetStartupInfo', 'GetSystemDefaultLangId', 'GetSystemDEPPolicy', 
'GetSystemDirectory', 'GetSystemFirmwareTable', 'GetSystemInfo', 'GetSystemPowerStatus', 'GetSystemWow64Directory', 'GetTapeParameters', 'GetTapePosition', 
'GetTapeStatus', 'GetTapeStatus', 'GetTaskmanWindow', 'GetTcpStatistics', 'GetTcpStatisticsEx', 'GetTcpTable', 'GetTempFileName', 'GetTempPath', 
'GetThreadContext', 'GetThreadDesktop', 'GetThreadLocale', 'GetThreadPriority', 'GetThreadSelectorEntry', 'GetThreadTimes', 'GetTickCount', 
'GetTimestampForLoadedLibrary', 'GetTimeZoneInformation', 'GetTokenInformation', 'GetTraceEnableFlags', 'GetTraceEnableLevel', 'GetTraceLoggerHandle', 
'GetTrusteeForm', 'GetTrusteeName', 'GetTrusteeType', 'GetTypeByName', 'GetUdpTable', 'GetUpdatedClipboardFormats', 'GetUrlCacheEntryInfo', 
'GetUrlCacheEntryInfoEx', 'GetUserGeoID', 'GetUserName', 'GetUserNameEx', 'GetUserObjectInformation', 'GetUserObjectSecurity', 'GetUserProfileDirectory', 
'GetVersionEx', 'GetVolumeInformation', 'GetVolumeNameForVolumeMountPoint', 'GetVolumePathName', 'GetVolumePathNamesForVolumeName', 
'GetWindowCompositionAttribute', 'GetWindowModuleFileName', 'GetWindowsAccountDomainSid', 'GetWindowsDirectory', 'GetWindowThreadProcessId', 'GetWriteWatch', 
'GetWsChanges', 'GetWsChangesEx', 'GhostWindowFromHungWindow', 'GlobalAddAtom', 'GlobalCompact', 'GlobalDeleteAtom', 'GlobalFindAtom', 'GlobalGetAtomName', 
'GlobalMemoryStatus', 'GlobalMemoryStatusEx', 'GlobalUnfix', 'GlobalUnWire', 'GUICtrlSendMsg', 'GUICtrlSendToDummy', 'GUICtrlSetBkColor', 'GUICtrlSetColor', 
'GUICtrlSetCursor', 'GUICtrlSetData', 'GUIDFormatToGlobalPowerPolicy', 'GUIDFormatToPowerPolicy', 

'Heap32First', 'Heap32ListFirst', 'Heap32ListNext', 'Heap32Next', 'HeapCreate', 'HeapQueryInformation', 'HeapSetInformation', 'HeapSummary', 'HeapWalk', 
'HlinkClone', 'HlinkCreateBrowseContext', 'HlinkCreateExtensionServices', 'HlinkCreateFromData', 'HlinkCreateFromMoniker', 'HlinkCreateFromString', 
'HlinkCreateShortcut', 'HlinkCreateShortcutFromMoniker', 'HlinkCreateShortcutFromString', 'HlinkGetSpecialReference', 'HlinkGetValueFromParams', 'HlinkGoBack', 
'HlinkGoForward', 'HlinkIsShortcut', 'HlinkNavigate', 'HlinkNavigateMoniker', 'HlinkNavigateString', 'HlinkNavigateToStringReference', 'HlinkOnNavigate', 
'HlinkOnRenameDocument', 'HlinkParseDisplayName', 'HlinkPreprocessMoniker', 'HlinkQueryCreateFromData', 'HlinkResolveMonikerForData', 'HlinkResolveShortcut', 
'HlinkResolveShortcutToMoniker', 'HlinkResolveShortcutToString', 'HlinkResolveStringForData', 'HlinkSetSpecialReference', 'HlinkSimpleNavigateToMoniker', 
'HlinkSimpleNavigateToString', 'HlinkTranslateURL', 'HlinkUpdateStackItem', 'htons', 'HttpAddRequestHeaders', 'HttpEndRequest', 'httpinjects', 'HttpOpenRequest', 
'HttpQueryInfo', 'HttpSendRequest', 'HttpSendRequestEx', 'httpshots', 'HungWindowFromGhostWindow', 

'I_NetLogonControl', 'I_NetLogonControl2', 'I_RpcMapWin32Status', 'Icmp6CreateFile', 'Icmp6ParseReplies', 'Icmp6SendEcho2', 'IcmpCloseHandle', 'IcmpCloseHandle', 
'IcmpCreateFile', 'IcmpCreateFile', 'IcmpParseReplies', 'IcmpParseReplies', 'IcmpSendEcho', 'IcmpSendEcho', 'IcmpSendEcho', 'IcmpSendEcho2', 'IcmpSendEcho2', 
'IcmpSendEcho2', 'IcmpSendEcho2Ex', 'ImageAddCertificate', 'ImageDirectoryEntryToData', 'ImageDirectoryEntryToData', 'ImageDirectoryEntryToDataEx', 
'ImageEnumerateCertificates', 'ImageGetCertificateData', 'ImageGetCertificateHeader', 'ImageGetDigestStream', 'ImagehlpApiVersion', 'ImagehlpApiVersionEx', 
'ImageLoad', 'ImageNtHeader', 'ImageNtHeader', 'ImageRecompress', 'ImageRemoveCertificate', 'ImageRvaToSection', 'ImageRvaToVa', 'ImageUnload', 'ImmGetContext', 
'ImpersonateAnonymousToken', 'ImpersonateLoggedOnUser', 'ImpersonateNamedPipeClient', 'ImpersonateSelf', 'inet_addr', 'inet_addr', 'inet_ntoa', 'inet_ntoa', 
'InetDialHandler', 'InitAtomTable', 'InitializeAcl', 'InitializeChangeNotify', 'InitializeProcessForWsWatch', 'InitializeSecurityDescriptor', 'InitializeSid', 
'InitiateSystemShutdown', 'InitiateSystemShutdownEx', 'Inject32End', 'Inject32Normal', 'Inject32Start', 'InjectApcRoutine', 'InjectNormRoutine', 'InSendMessage', 
'InSendMessageEx', 'InstallApplication', 'Int64ToString', 'InterlockedPushEntrySList', 'InternalGetUdpTable', 'InternalSetIpForwardEntry', 'InternalSetIpStats', 
'InternetAutodial', 'InternetAutodialHangup', 'InternetCanonicalizeUrl', 'InternetCheckConnection', 'InternetCloseHandle', 'InternetCloseHandle', 
'InternetCombineUrl', 'InternetConnect', 'InternetConnect', 'InternetCrackUrl', 'InternetCrackUrl', 'InternetErrorDlg', 'InternetFindNextFile', 
'InternetGetConnectedState', 'InternetGetConnectedStateEx', 'InternetGetCookie', 'InternetGetCookieEx', 'InternetGetLastResponseInfo', 'InternetOpen', 
'InternetOpen', 'InternetOpen', 'InternetOpenUrl', 'InternetOpenUrl', 'InternetQueryDataAvailable', 'InternetQueryDataAvailable', 'InternetQueryOption', 
'InternetQueryOption', 'InternetReadFile', 'InternetReadFileEx', 'InternetSecurityProtocolToString', 'InternetSetCookie', 'InternetSetOption', 'InternetSetOption', 
'InternetSetStatusCallback', 'InternetWriteFile', 'InternetWriteFile', 'InvalidateConsoleDIBits', 'IoAllocateAdapterChannel', 'IoAttachDeviceByPointer', 
'IoCreateDevice', 'IoCreateFile', 'ioctlsocket', 'IoDeleteDevice', 'IoGetCurrentProcess', 'IoRegisterBootDriverReinitialization', 'IsAdminOverrideActive', 
'IsClipboardFormatAvailable', 'IsDebuggerPresent', 'IsElevationRequired', 'IsNativeVhdBoot', 'IsNetworkAlive', 'IsNTAdmin', 'IsProcessorFeaturePresent', 
'IsPwrHibernateAllowed', 'IsPwrShutdownAllowed', 'IsPwrSuspendAllowed', 'IsSearchEnabled', 'IsServerSideWindow', 'IsSETEnabled', 'IsSystemResumeAutomatic', 
'IsThreadDesktopComposited', 'IsTokenRestricted', 'IStream_ReadStrLong', 'IStream_WriteStrLong', 'IsUserAnAdmin', 'IsValidAcl', 'IsValidLanguageGroup', 
'IsValidSecurityDescriptor', 'IsValidSid', 'IsValidURL', 'IsWellKnownSid', 'IsWindowInDestroy', 'IsWindowVisible', 'IsWoW64Process', 
'IUnknown_RemoveBackReferences', 'IUnknown_TranslateAcceleratorGlobal', 'IUnknown_TranslateAcceleratorIO', 

'JournalPlaybackProc', 

'K32EnumProcesses', 'K32EnumProcessModules', 'K32GetModuleBaseName', 'K32GetModuleFileNameEx', 'K32GetProcessImageFileName', 'KeAddSystemServiceTable', 
'KeBugCheckEx', 'kernel32.FindFirstFileW', 'kernel32.FindResourceW', 'KeServiceDescriptorTable', 'KeTickCount', 'keybd_event', 'KillSystemTimer', 
'LargeIntegerToString', 'ldap_memfree', 'LdrAccessResource', 'LdrAddLoadAsDataTable', 'LdrAddRefDll', 'LdrDisableThreadCalloutsForDll', 
'LdrEnumerateLoadedModules', 'LdrEnumResources', 'LdrFindEntryForAddress', 'LdrFindResource_U', 'LdrFindResourceDirectory_U', 'LdrFindResourceEx_U', 
'LdrFlushAlternateResourceModules', 'LdrGetDllHandle', 'LdrGetDllHandleByMapping', 'LdrGetDllHandleByName', 'LdrGetDllHandleEx', 'LdrGetFailureData', 
'LdrGetFileNameFromLoadAsDataTable', 'LdrGetKnownDllSectionHandle', 'LdrGetProcedureAddress', 'LdrGetProcedureAddressEx', 'LdrHotPatchRoutine', 
'LdrInitializeThunk', 'LdrInitShimEngineDynamic', 'LdrLoadAlternateResourceModule', 'LdrLoadAlternateResourceModuleEx', 'LdrLoadDll', 'LdrLockLoaderLock', 
'LdrOpenImageFileOptionsKey', 'LdrpResGetMappingSize', 'LdrpResGetResourceDirectory', 'LdrProcessRelocationBlock', 'LdrQueryImageFileExecutionOptions', 
'LdrQueryImageFileExecutionOptionsEx', 'LdrQueryImageFileKeyOption', 'LdrQueryModuleServiceTags', 'LdrQueryProcessModuleInformation', 'LdrRegisterDllNotification', 
'LdrRemoveLoadAsDataTable', 'LdrResFindResource', 'LdrResFindResourceDirectory', 'LdrResGetRCConfig', 'LdrResRelease', 'LdrResSearchResource', 'LdrRscIsTypeExist', 
'LdrSetAppCompatDllRedirectionCallback', 'LdrSetDllManifestProber', 'LdrSetMUICacheType', 'LdrShutdownProcess', 'LdrShutdownThread', 'LdrSystemDllInitBlock', 
'LdrUnloadAlternateResourceModule', 'LdrUnloadAlternateResourceModuleEx', 'LdrUnloadDll', 'LdrUnlockLoaderLock', 'LdrUnregisterDllNotification', 
'LdrVerifyImageMatchesChecksum', 'LdrVerifyImageMatchesChecksumEx', 'LdrWx86FormatVirtualImage', 'LinkWindow_RegisterClass', 'listen', 'LoadCurrentPwrScheme', 
'LoadLibrary', 'LoadLibraryEx', 'LoadRegTypeLib', 'LoadResource', 'LoadTypeLib', 'LoadTypeLibEx', 'LoadUserProfile', 'LocalCompact', 'LocalFlags', 'LockFile', 
'LockFileEx', 'LockHandle', 'LockResource', 'LockServiceDatabase', 'LockSetForegroundWindow', 'LockWindowStation', 'LockWorkStation', 'LockWorkStation', 
'LogonIdFromWinStationNameA', 'LogonIdFromWinStationNameW', 'LogonUser', 'longjmp', 'LookupAccountName', 'LookupAccountSid', 'LookupPrivilegeDisplayName', 
'LookupPrivilegeName', 'LookupPrivilegeValue', 'LookupPrivilegeValue', 'LookupSecurityDescriptorParts', 'LsaAddAccountRights', 'LsaCallAuthenticationPackage', 
'LsaClose', 'LsaConnectUntrusted', 'LsaCreateAccount', 'LsaCreateSecret', 'LsaCreateTrustedDomain', 'LsaCreateTrustedDomainEx', 'LsaDeleteTrustedDomain', 
'LsaDeregisterLogonProcess', 'LsaEnumerateAccountRights', 'LsaEnumerateAccounts', 'LsaEnumerateAccountsWithUserRight', 'LsaEnumerateLogonSessions', 
'LsaEnumeratePrivilegesOfAccount', 'LsaEnumerateTrustedDomains', 'LsaFreeMemory', 'LsaGetLogonSessionData', 'LsaLookupAuthenticationPackage', 'LsaOpenPolicy', 
'LsaOpenSecret', 'LsaQueryTrustedDomainInfo', 'LsaRetrievePrivateData', 'LsaSetInformationTrustedDomain', 'LsaSetQuotasForAccount', 'LsaSetSecret', 
'LsaSetSecurityObject', 'LsaUnregisterPolicyChangeNotification', 'LZClose', 'LZCopy', 'LZCopy', 'LZCreateFile', 'LZCreateFile', 'LZDone', 'LZInit', 'LZInit', 
'LZOpenFile', 'LZOpenFile', 'LZSeek', 'LZSeek', 'LZStart', 'LZStart', 

'MakeAbsoluteSD', 'MakeAbsoluteSD2', 'MakeSelfRelativeSD', 'MakeSureDirectoryPathExists', 'MapAndLoad', 'MapDebugInformation', 'MapFileAndCheckSum', 
'MapGenericMask', 'MAPILogonEx', 'MapUserPhysicalPagesScatter', 'MapViewOfFile', 'MapViewOfFileEx', 'MapVirtualKey', 'MapVirtualKeyEx', 'MapWin32ErrorToSTG', 
'MB_GetString', 'MBToWCSEx', 'MD5Final', 'MD5Init', 'MD5Update', 'MergeLegacyPwrScheme', 'MethCallEngine', 'MigrateWinsockConfiguration', 'MiniDumpWriteDump', 
'MmCreateMdl', 'MmGetSystemAddressForMdl', 'MmGetSystemRoutineAddress', 'MmIsThisAnNtAsSystem', 'MmMapLockedPages', 'ModeToCreateFileFlags', 'Module32First', 
'Module32Next', 'MonitorEnumProc', 'MonitorFromPoint', 'MonitorFromRect', 'MonitorFromWindow', 'mouse_event', 'MoveFile', 'MoveFileEx', 'MoveFileTransacted', 
'MoveFileWithProgress', 'MprAdminUserClose', 'MprAdminUserGetInfo', 'MprAdminUserOpen', 'MprAdminUserRead', 'MprAdminUserUserClose', 'MprAdminUserUserOpen', 
'MprAdminUserWrite', 'MsiCloseHandle', 'MsiConfigureProductEx', 'MsiCreateAndVerifyInstallerDirectory', 'MsiCreateRecord', 'MsiDecomposeDescriptor', 
'MsiDecomposeDescriptor', 'MsiDeleteUserDataA', 'MsiDeleteUserDataW', 'MsiEnableLog', 'MsiEnumComponentCostsA', 'MsiEnumComponentCostsW', 
'MsiEnumComponentQualifiers', 'MsiEnumProducts', 'MsiEnumRelatedProductsA', 'MsiEnumRelatedProductsW', 'MsiFormatRecord', 'MsiGetComponentPath', 
'MsiGetFileHashA', 'MsiGetFileHashW', 'MsiGetFileSignatureInformationA', 'MsiGetFileSignatureInformationW', 'MsiGetProductCode', 'MsiGetProductInfoW', 
'MsiInstallProduct', 'MsiIsProductElevatedA', 'MsiIsProductElevatedW', 'MsiLocateComponent', 'MsiOpenPackageExA', 'MsiOpenPackageExW', 
'MsiProvideQualifiedComponentEx', 'MsiProvideQualifiedComponentEx', 'MsiQueryFeatureState', 'MsiRecordGetFieldCount', 'MsiRecordGetInteger', 
'MsiRecordGetString', 'MsiRecordReadStream', 'MsiRecordSetStrings', 'MsiReinstallFeatureW', 'MsiRemovePatches', 'MsiSetExternalUI', 'MsiSetFeatureAttributesA', 
'MsiSetFeatureAttributesW', 'MsiSetInternalUI', 'MsiSourceListAddSourceA', 'MsiSourceListAddSourceW', 'MsiSourceListForceResolutionA', 
'MsiSourceListForceResolutionW', 'MsiSummaryInfoPersist', 'MultinetGetConnectionPerformance', 

'Navigate', 'Navigate2', 'NDdeGetErrorString', 'NDdeGetErrorString', 'NDdeGetShareSecurity', 'NDdeGetShareSecurity', 'NDdeGetTrustedShare', 'NDdeGetTrustedShare', 
'NDdeIsValidAppTopicList', 'NDdeIsValidAppTopicList', 'NDdeIsValidShareName', 'NDdeIsValidShareName', 'NDdeSetShareSecurity', 'NDdeSetShareSecurity', 
'NDdeSetTrustedShare', 'NDdeSetTrustedShare', 'NDdeShareAdd', 'NDdeShareAdd', 'NDdeShareDel', 'NDdeShareDel', 'NDdeShareEnum', 'NDdeShareEnum', 'NDdeShareGetInfo', 
'NDdeShareGetInfo', 'NDdeShareSetInfo', 'NDdeShareSetInfo', 'NDdeSpecialCommand', 'NDdeSpecialCommand', 'NDdeTrustedShareEnum', 'NDdeTrustedShareEnum', 
'NdrAsyncClientCall', 'NdrClearOutParameters', 'NdrClientCall', 'NdrClientCall2', 'NdrConformantArrayUnmarshall', 'NdrConformantStringBufferSize', 
'NdrConformantStringMarshall', 'NdrConformantStringUnmarshall', 'NdrContextHandleInitialize', 'NdrContextHandleMemorySize', 'NdrContextHandleSize', 'NdrConvert', 
'NdrCStdStubBuffer_Release', 'NdrCStdStubBuffer2_Release', 'NdrDllCanUnloadNow', 'NdrDllGetClassObject', 'NdrDllRegisterProxy', 'NdrDllUnregisterProxy', 
'NdrGetUserMarshalInfo', 'NdrInterfacePointerBufferSize', 'NdrInterfacePointerFree', 'NdrInterfacePointerMarshall', 'NdrInterfacePointerUnmarshall', 
'NdrOleAllocate', 'NdrOleFree', 'NdrPointerBufferSize', 'NdrPointerFree', 'NdrPointerMarshall', 'NdrPointerUnmarshall', 'NdrProxyErrorHandler', 
'NdrProxyFreeBuffer', 'NdrProxyGetBuffer', 'NdrProxyInitialize', 'NdrProxySendReceive', 'NdrSimpleTypeMarshall', 'NdrSimpleTypeUnmarshall', 'NdrStubCall2', 
'NdrStubForwardingFunction', 'NdrStubGetBuffer', 'NdrStubInitialize', 'NdrUserMarshalBufferSize', 'NdrUserMarshalFree', 'NdrUserMarshalMarshall', 'NetAccessAdd', 
'NetAccessDel', 'NetAccessEnum', 'NetAccessGetInfo', 'NetAccessGetUserPerms', 'NetAccessSetInfo', 'NetAuditClear', 'NetAuditRead', 'Netbios', 
'NetBrowserStatisticsGet', 'NetConfigSet', 'NetConnectionEnum', 'NetEnumerateTrustedDomains', 'NetErrorLogClear', 'NetErrorLogRead', 'NetErrorLogWrite', 
'NetFileClose', 'NetFileGetInfo', 'NetGetAnyDCName', 'NetGetDCName', 'NetGetDisplayInformationIndex', 'NetGetJoinInformation', 'NetGroupAdd', 'NetGroupAddUser', 
'NetGroupDel', 'NetGroupDelUser', 'NetGroupEnum', 'NetGroupGetInfo', 'NetGroupGetUsers', 'NetGroupSetInfo', 'NetGroupSetUsers', 'NetLocalGroupAdd', 
'NetLocalGroupAddMember', 'NetLocalGroupAddMembers', 'NetLocalGroupDel', 'NetLocalGroupDelMember', 'NetLocalGroupDelMembers', 'NetLocalGroupEnum', 
'NetLocalGroupGetInfo', 'NetLocalGroupGetMembers', 'NetLocalGroupSetInfo', 'NetLocalGroupSetMembers', 'NetpwNameValidate', 'NetQueryDisplayInformation', 
'NetRemoteTOD', 'NetScheduleJobAdd', 'NetServerEnum', 'NetServerGetInfo', 'NetServiceEnum', 'NetSessionEnum', 'NetShareAdd', 'NetShareDel', 'NetShareEnum', 
'NetShareGetInfo', 'NetStatisticsGet', 'NetUserAdd', 'NetUserChangePassword', 'NetUserDel', 'NetUserEnum', 'NetUserGetGroups', 'NetUserGetInfo', 
'NetUserGetLocalGroups', 'NetUserModalsGet', 'NetUserModalsSet', 'NetUserSetGroups', 'NetUserSetInfo', 'NetValidatePasswordPolicy', 'NetValidatePasswordPolicyFree', 
'NetWkstaGetInfo', 'NetWkstaTransportEnum', 'NetWkstaUserEnum', 'NetWkstaUserGetInfo', 'NhGetGuidFromInterfaceName', 'NhpAllocateAndGetInterfaceInfoFromStack', 
'NlsGetCacheUpdateCount', 'NotifyChangeEventLog', 'NotifyChangeEventLog', 'NotifyWinEvent', 'NPLoadNameSpaces', 'NtAccessCheckByTypeResultListAndAuditAlarm', 
'NtAddAtom', 'NtAdjustPrivilegesToken', 'NtCompareTokens', 'NtContinue', 'NtCreateFile', 'NtCreateProcess', 'NtCreateProcessEx', 'NtCreateSection', 
'NtCreateThread', 'NtCreateUserProcess', 'NtDelayExecution', 'NtDeleteFile', 'NtDeleteKey', 'NtEnumerateKey', 'NtEnumerateValueKey', 'NtFsControlFile', 
'NtGetContextThread', 'NtImpersonateAnonymousToken', 'NtLoadDriver', 'NtLoadKey', 'NtMapViewOfSection', 'ntohs', 'NtOpenEvent', 'NtOpenFile', 'NtOpenKey', 
'NtOpenProcess', 'NtOpenProcessToken', 'NtOpenSection', 'NtOpenSymbolicLinkObject', 'NtOpenThreadToken', 'NtProtectVirtualMemory', 'NtQueryDirectoryFile', 
'NtQueryInformationFile', 'NtQueryInformationProcess', 'NtQueryInformationThread', 'NtQueryKey', 'NtQueryObject', 'NtQuerySymbolicLinkObject', 
'NtQuerySystemInformation', 'NtQueryVirtualMemory', 'NtRaiseHardError', 'NtResumeProcess', 'NtResumeThread', 'NtSetContextThread', 'NtSetEvent', 
'NtSetInformationFile', 'NtSetInformationProcess', 'NtSetInformationThread', 'NtSetSecurityObject', 'NtSuspendProcess', 'NtTerminateProcess', 'NtUnloadDriver', 
'NtUnloadKey', 'NtUnmapViewOfSection', 'NtUserSetChildWindowNoActivate', 'NtWow64CallFunction64', 'NtWow64CsrAllocateCaptureBuffer', 
'NtWow64CsrAllocateMessagePointer', 'NtWow64CsrCaptureMessageBuffer', 'NtWow64CsrCaptureMessageString', 'NtWow64CsrClientCallServer', 
'NtWow64CsrClientConnectToServer', 'NtWow64CsrFreeCaptureBuffer', 'NtWow64CsrGetProcessId', 'NtWow64CsrIdentifyAlertableThread', 'NtWow64CsrVerifyRegion', 
'NtWow64DebuggerCall', 'NtWow64GetCurrentProcessorNumberEx', 'NtWow64GetNativeSystemInformation', 'NtWow64InterlockedPopEntrySList', 
'NtWow64QueryInformationProcess64', 'NtWow64QueryVirtualMemory64', 'NtWow64ReadVirtualMemory64', 'NtWow64WriteVirtualMemory64', 'NtWriteFile', 
'NtWriteVirtualMemory', 

'ObjectCloseAuditAlarm', 'ObjectDeleteAuditAlarm', 'ObjectOpenAuditAlarm', 'ObjectPrivilegeAuditAlarm', 'ObtainUserAgentString', 'ODBCInternalConnect', 
'ODBCInternalConnectW', 'ODBCQualifyFileDSNW', 'OemKeyScan', 'OleFlushClipboard', 'OleGetClipboard', 'OleInitialize', 'OleInitialize', 'OleIsCurrentClipboard', 
'OleLoad', 'OleRegEnumFormatEtc', 'OleRegEnumVerbs', 'OleRun', 'OleSetClipboard', 'OleUIAddVerbMenuA', 'OleUIConvertA', 'OleUIEditLinksA', 'OleUninitialize', 
'OneXAddEapAttributes', 'OneXAddTLV', 'OneXCompareAuthParams', 'OneXCopyAuthParams', 'OneXCreateDefaultProfile', 'OneXCreateDiscoveryProfiles', 
'OneXCreateSupplicantPort', 'OneXDeInitialize', 'OpenAs_RunDLLA', 'OpenAs_RunDLLW', 'OpenBackupEventLog', 'OpenClipboard', 'OpenConsole', 'OpenDesktop', 
'OpenEncryptedFileRaw', 'OpenEventLog', 'OpenFileMapping', 'OpenInputDesktop', 'OpenMutex', 'OpenODBCPerfData', 'OpenODBCPerfData', 'OpenProcess', 
'OpenProcessToken', 'OpenProfileUserMapping', 'OpenSCManager', 'OpenSemaphore', 'OpenService', 'OpenThread', 'OpenThreadToken', 'OpenTrace', 'OpenWindowStation', 
'OpenWindowStation', 'Options_RunDLL', 'Options_RunDLLA', 'Options_RunDLLW', 'OutputDebugString', 'OutputDebugStringWrap', 

'PackDDElParam', 'PacketAllocatePacket', 'PacketCloseAdapter', 'PacketFreePacket', 'PacketGetAdapterNames', 'PacketGetAirPcapHandle', 'PacketGetDriverVersion', 
'PacketGetNetInfoEx', 'PacketGetNetType', 'PacketGetReadEvent', 'PacketGetStats', 'PacketGetStatsEx', 'PacketGetVersion', 'PacketInitPacket', 'PacketIsDumpEnded', 
'PacketLibraryVersion', 'PacketOpenAdapter', 'PacketReceivePacket', 'PacketRequest', 'PacketSendPacket', 'PacketSendPackets', 'PacketSetBpf', 'PacketSetBuff', 
'PacketSetDumpLimits', 'PacketSetDumpName', 'PacketSetHwFilter', 'PacketSetLoopbackBehavior', 'PacketSetMinToCopy', 'PacketSetMode', 'PacketSetNumWrites', 
'PacketSetReadTimeout', 'PacketSetSnapLen', 'PacketStopDriver', 'PathCombine', 'PathFindExtension', 'PathFindFileName', 'PathGetDriveNumber', 
'PathGetPathDisplayName', 'PathIsDirectory', 'PathIsDirectoryEmpty', 'PathIsTemporary', 'PathIsURL', 'PathRemoveFileSpec', 'PathRenameExtension', 
'PathUnExpandEnvStringsForUserW', 'PathUnExpandSystemEnvStringsW', 'PDBOpenValidate5', 'PdhAddCounter', 'PdhCloseQuery', 'PdhCollectQueryData', 
'PdhGetFormattedCounterValue', 'PdhOpenQuery', 'PeekConsoleInput', 'PeekMessage', 'PeekNamedPipe', 'PortCompressionSetInfo', 'PostComponentError', 
'PostMessage', 'PostODBCComponentError', 'PostODBCError', 'PostQuitMessage', 'PostThreadMessage', 'PowerApplyPowerRequestOverride', 
'PowerCanRestoreIndividualDefaultPowerScheme', 'PowerCreatePossibleSetting', 'PowerCreateSetting', 'PowerCustomizePlatformPowerSettings', 
'PowerDebugDifPowerPolicies', 'PowerDebugDifSystemPowerPolicies', 'PowerDebugDumpPowerPolicy', 'PowerDebugDumpPowerScheme', 
'PowerDebugDumpSystemPowerCapabilities', 'PowerDebugDumpSystemPowerPolicy', 'PowerDeleteScheme', 'PowerDeterminePlatformRole', 'PowerDuplicateScheme', 
'PowerEnumerate', 'PowerGetActiveScheme', 'PowerImportPowerScheme', 'PowerOpenSystemPowerKey', 'PowerOpenUserPowerKey', 'PowerPolicyToGUIDFormat', 
'PowerReadACDefaultIndex', 'PowerReadACValue', 'PowerReadACValueIndex', 'PowerReadDCDefaultIndex', 'PowerReadDCValue', 'PowerReadDCValueIndex', 
'PowerReadDescription', 'PowerReadFriendlyName', 'PowerReadIconResourceSpecifier', 'PowerReadPossibleDescription', 'PowerReadPossibleFriendlyName', 
'PowerReadPossibleValue', 'PowerReadSecurityDescriptor', 'PowerReadSettingAttributes', 'PowerReadValueIncrement', 'PowerReadValueMax', 'PowerReadValueMin', 
'PowerReadValueUnitsSpecifier', 'PowerRemovePowerSetting', 'PowerReplaceDefaultPowerSchemes', 'PowerRestoreDefaultPowerSchemes', 
'PowerRestoreIndividualDefaultPowerScheme', 'PowerSetActiveScheme', 'PowerSetAlsBrightnessOffset', 'PowerSettingAccessCheck', 'PowerSettingRegisterNotification', 
'PowerSettingUnregisterNotification', 'PowerWriteACDefaultIndex', 'PowerWriteACValueIndex', 'PowerWriteDCDefaultIndex', 'PowerWriteDCValueIndex', 
'PowerWriteDescription', 'PowerWriteFriendlyName', 'PowerWriteIconResourceSpecifier', 'PowerWritePossibleDescription', 'PowerWritePossibleFriendlyName', 
'PowerWritePossibleValue', 'PowerWriteSecurityDescriptor', 'PowerWriteSettingAttributes', 'PowerWriteValueIncrement', 'PowerWriteValueMax', 'PowerWriteValueMin', 
'PowerWriteValueUnitsSpecifier', 'PrepareTape', 'Printer_AddPrinterPropPages', 'Printer_LoadIcons', 'Printers_RegisterWindow', 'Printers_UnregisterWindow', 
'PrivilegeCheck', 'PrivilegedServiceAuditAlarm', 'ProcCallEngine', 'Process32First', 'Process32Next', 'ProcessIdToSessionId', 'ProcessTrace', 'PsChargePoolQuota', 
'PsCreateSystemThread', 'PsDereferenceImpersonationToken', 'PsDereferencePrimaryToken', 'PsGetCurrentProcessId', 'PsGetProcessExitTime', 'PsGetVersion', 
'PsImpersonateClient', 'PsInitialSystemProcess', 'PsIsDiskCountersEnabled', 'PsIsThreadTerminating', 'PsLookupProcessByProcessId', 'PsLookupProcessByProcessId', 
'PsLookupProcessThreadByCid', 'PsLookupThreadByThreadId', 'PsReferenceImpersonationToken', 'PsReferencePrimaryToken', 'PsReturnPoolQuota', 'PsRevertToSelf', 
'PsSetCreateProcessNotifyRoutine', 'PsSetLoadImageNotifyRoutine', 'PsTerminateSystemThread', 'PStoreCreateInstance', 'PStoreEnumProviders', 'PsUpdateDiskCounters', 
'PurgeComm', 'PvkFreeCryptProv', 'PvkGetCryptProv', 'PvkPrivateKeyAcquireContext', 'PvkPrivateKeyAcquireContextFromMemory', 'PvkPrivateKeyLoad', 
'PvkPrivateKeyLoadFromMemory', 'PvkPrivateKeyReleaseContext', 'PvkPrivateKeySave', 'PvkPrivateKeySaveToMemory', 

'QueryAllTraces', 'QueryDosDevice', 'QueryFullProcessImageName', 'QueryPerformanceCounter', 'QueryPerformanceFrequency', 'QueryRecoveryAgentsOnEncryptedFile', 
'QuerySecurityAccessMask', 'QuerySendMessage', 'QueryServiceConfig', 'QueryServiceConfig2', 'QueryServiceObjectSecurity', 'QueryServiceStatus', 
'QueryServiceStatusEx', 'QuerySourceCreateFromKey', 'QuerySourceCreateFromKeyEx', 'QueryWorkingSet', 'QueryWorkingSet', 'QueryWorkingSetEx', 'QueueUserAPC', 
'QueueUserAPC', 

'RaiseException', 'RasEnumEntries', 'RasGetConnectStatus', 'RasHangUp', 'ReadCabinetState', 'ReadConsole', 'ReadConsoleInput', 'ReadConsoleInputEx', 
'ReadConsoleOutputCharacter', 'ReadDirectoryChanges', 'ReadEncryptedFileRaw', 'ReadEventLog', 'ReadFileScatter', 'ReadGlobalPwrPolicy', 'ReadProcessMemory', 
'ReadProcessMemory', 'ReadProcessorPwrScheme', 'ReadPwrScheme', 'RealShellExecute', 'RealShellExecuteA', 'RealShellExecuteEx', 'RealShellExecuteExA', 
'RealShellExecuteExW', 'RealShellExecuteW', 'ReasonCodeNeedsBugID', 'ReBaseImage', 'ReBaseImage64', 'RecordShutdownReason', 'recv', 'recv', 'recvfrom', 
'redirects', 'RefreshBrowserLayout', 'RefreshPolicy', 'RegConnectRegistry', 'RegCopyTree', 'RegCreateKey', 'RegCreateKeyEx', 'RegDeleteKey', 'RegDeleteValue', 
'RegDisablePredefinedCache', 'RegDisablePredefinedCacheEx', 'RegDisableReflectionKey', 'RegEnableReflectionKey', 'RegenerateUserEnvironment', 'RegEnumKey', 
'RegEnumKeyEx', 'RegFlushKey', 'RegGetKeySecurity', 'register_icmp', 'register_icmp', 'RegisterBindStatusCallback', 'RegisterClipboardFormat', 
'RegisterClipboardFormat', 'RegisterConsoleVDM', 'RegisterDeviceNotification', 'RegisterEventSource', 'RegisterEventSource', 'RegisterHotKey', 
'RegisterRawInputDevices', 'RegisterServiceCtrlHandler', 'RegisterServiceCtrlHandlerEx', 'RegisterShellHookWindow', 'RegisterShellHookWindow', 
'RegisterSystemThread', 'RegisterTasklist', 'RegisterTypeLib', 'RegisterUserApiHook', 'RegisterWindowMessage', 'RegisterWowBaseHandlers', 'RegLoadKey', 
'RegNotifyChangeKeyValue', 'RegOpenKey', 'RegOverridePredefKey', 'RegQueryMultipleValues', 'RegReplaceKey', 'RegRestoreKey', 'RegSaveKey', 'RegSetKeySecurity', 
'RegSetValue', 'RegSetValueEx', 'RegUnLoadKey', 'ReleaseMutex', 'ReleaseSemaphore', 'RemoteAssistancePrepareSystemRestore', 'RemoveClipboardFormatListener', 
'RemoveDirectory', 'RemovePrivateCvSymbolic', 'RemovePrivateCvSymbolicEx', 'RemoveRelocations', 'RemoveUsersFromEncryptedFile', 'RemoveVectoredExceptionHandler', 
'ReplaceFile', 'ReplyMessage', 'ReportEvent', 'ReportEvent', 'ResolveDelayLoadedAPI', 'ResolveDelayLoadsFromDll', 'RestoreLastError', 'ResumeSuspendedDownload', 
'ResumeThread', 'RevertToSelf', 'RpcMgmtSetServerStackSize', 'RpcMgmtStopServerListening', 'RpcMgmtWaitServerListen', 'RpcServerListen', 'RpcServerRegisterIf', 
'RpcServerTestCancel', 'RpcServerUnregisterIf', 'RpcServerUnregisterIfEx', 'RpcServerUseProtseqEp', 'RpcStringFree', 'RsopResetPolicySettingStatus', 
'RsopSetPolicySettingStatus', 'rtcKillFiles', 'rtcMakeDir', 'rtcRandomNext', 'rtcSetFileAttr', 'rtcShell', 'RtlAcquireResourceExclusive', 'RtlAcquireResourceShared', 
'RtlAddFunctionTable', 'RtlAdjustPrivilege', 'RtlAllocateAndInitializeSid', 'RtlCaptureContext', 'RtlCaptureStackBackTrace', 'RtlCompareMemory', 'RtlCompressBuffer', 
'RtlComputeCrc32', 'RtlConvertSidToUnicodeString', 'RtlCreateRegistryKey', 'RtlCreateSecurityDescriptor', 'RtlDecompressBuffer', 'RtlDelete', 'RtlDeleteResource', 
'RtlDumpResource', 'RtlEnterCriticalSection', 'RtlFormatCurrentUserKeyPath', 'RtlGetCompressionWorkSpaceSize', 'RtlImageDirectoryEntryToData', 'RtlImageNtHeader', 
'RtlInitializeResource', 'RtlLeaveCriticalSection', 'RtlLockCurrentThread', 'RtlLookupFunctionEntry', 'RtlMoveMemory', 'RtlNtStatusToDosError', 
'RtlQueryElevationFlags', 'RtlQueryRegistryValues', 'RtlRandom', 'RtlReleaseResource', 'RtlSetDaclSecurityDescriptor', 'RtlSetOwnerSecurityDescriptor', 
'RtlSetProcessIsCritical', 'RtlTimeToSecondsSince1970', 'RtlTraceDatabaseAdd', 'RtlTraceDatabaseCreate', 'RtlTraceDatabaseDestroy', 'RtlTraceDatabaseEnumerate', 
'RtlTraceDatabaseFind', 'RtlTraceDatabaseLock', 'RtlTraceDatabaseUnlock', 'RtlTraceDatabaseValidate', 'RtlUnlockCurrentThread', 'RtlUserThreadStart', 
'RtlVirtualUnwind', 'RtlWriteRegistryValue', 'RunAsNewUser_RunDLL', 

'SaferIdentifyLevel', 'SaferiIsExecutableFileType', 'SaferRecordEventLogEntry', 'SamIConnect', 'SamIGetPrivateData', 'SamQueryInformationUse', 
'SCardAccessStartedEvent', 'SCardBeginTransaction', 'SCardControl', 'SCardDisconnect', 'SCardDlgExtendedError', 'SCardEndTransaction', 'SCardEstablishContext', 
'SCardListReaders', 'SCardReconnect', 'SCardReleaseContext', 'SCardReleaseStartedEvent', 'SCardStatus', 'SCardTransmit', 'SCardUIDlgSelectCardA', 
'SCardUIDlgSelectCardW', 'SceAddToNameList', 'SceAddToNameStatusList', 'SceAddToObjectList', 'SceAnalyzeSystem', 'SceAppendSecurityProfileInfo', 
'SceBrowseDatabaseTable', 'SceCloseProfile', 'SceCommitTransaction', 'SceCompareNameList', 'SceCompareSecurityDescriptors', 'SceConfigureConvertedFileSecurity,', 
'SceConfigureSystem', 'SceCopyBaseProfile', 'SceCreateDirectory', 'SceDcPromoCreateGPOsInSysvol', 'SceDcPromoCreateGPOsInSysvolEx', 'SceDcPromoteSecurity', 
'SceDcPromoteSecurityEx', 'SceEnforceSecurityPolicyPropagation', 'SceEnumerateServices', 'SceFreeMemory', 'SceFreeProfileMemory', 'SceGenerateGroupPolicy', 
'SceGenerateRollback', 'SceGetAnalysisAreaSummary', 'SceGetAreas', 'SceGetDatabaseSetting', 'SceGetDbTime', 'SceGetObjectChildren', 'SceGetObjectSecurity', 
'SceGetScpProfileDescription', 'SceGetSecurityProfileInfo', 'SceGetServerProductType', 'SceGetTimeStamp', 'SceIsSystemDatabase', 'SceLookupPrivRightName', 
'SceNotifyPolicyDelta', 'SceOpenPolicy', 'SceOpenProfile', 'SceProcessSecurityPolicyGPO', 'SceProcessSecurityPolicyGPOEx', 'SceRegisterRegValues', 
'SceRollbackTransaction', 'SceSetDatabaseSetting', 'SceSetupBackupSecurity', 'SceSetupConfigureServices', 'SceSetupGenerateTemplate', 'SceSetupMoveSecurityFile', 
'SceSetupRootSecurity', 'SceSetupSystemByInfName', 'SceSetupUnwindSecurityFile', 'SceSetupUpdateSecurityFile', 'SceSetupUpdateSecurityKey', 
'SceSetupUpdateSecurityService', 'SceStartTransaction', 'SceSvcConvertSDToText', 'SceSvcConvertTextToSD', 'SceSvcFree', 'SceSvcGetInformationTemplate', 
'SceSvcQueryInfo', 'SceSvcSetInfo', 'SceSvcSetInformationTemplate', 'SceSvcUpdateInfo', 'SceSysPrep', 'SceUpdateObjectInfo', 'SceUpdateSecurityProfile', 
'SceWriteSecurityProfileInfo', 'ScriptBreak', 'ScriptFreeCache', 'ScriptItemize', 'ScriptLayout', 'ScriptPlace', 'ScriptShape', 'ScriptStringAnalyse', 
'ScriptStringOut', 'SEAddMemoryGuard', 'SearchPath', 'SearchStatusCode', 'SearchTreeForFile', 'SECheckCountryID', 'SECheckExecTime', 'SECheckExpDate', 
'SECheckHardwareID', 'SECheckLicenseFile', 'SECheckLicenseFileEx', 'SECheckNumDays', 'SECheckNumExec', 'SECheckProtection', 'SECheckTotalExecTime', 
'SEDecodeString', 'SEDelMemoryGuard', 'SEFreeString', 'SEGetAppStatus', 'SEGetExecTimeLeft', 'SEGetExecTimeUsed', 'SEGetHardwareID', 'SEGetLicenseHash', 
'SEGetLicenseTrialInfo', 'SEGetLicenseUserInfo', 'SEGetNumDaysLeft', 'SEGetNumDaysUsed', 'SEGetNumExecLeft', 'SEGetNumExecUsed', 'SEGetProtectionDate', 
'SEGetTotalExecTimeLeft', 'SEGetTotalExecTimeUsed', 'select', 'SelectTransDlg', 'SelfDelete', 'send', 'send', 'Send', 'SendARP', 'SendAsyncProc', 'SendAttachMode', 
'SendCapslockMode', 'SendCommandID', 'SendKeepActive', 'SendKeyDelay', 'SendKeyDownDelay', 'SendLogs', 'SendMessage', 'SendMessageCallback', 'SendMessageTimeout', 
'SendNotifyMessage', 'sendto', 'SENotifyLicenseBanned', 'SEProtectEnd', 'SEProtectStart', 'SEProtectStartMutation', 'SEProtectStartUltra', 
'SEProtectStartVirtualization', 'SEResetTrial', 'ServerGetInternetConnectorStatus', 'ServerLicensingClose', 'ServerLicensingDeactivateCurrentPolicy', 
'ServerLicensingFreePolicyInformation', 'ServerLicensingGetAvailablePolicyIds', 'ServerLicensingGetPolicy', 'ServerLicensingGetPolicyInformationA', 
'ServerLicensingGetPolicyInformationW', 'ServerLicensingLoadPolicy', 'ServerLicensingOpenA', 'ServerLicensingOpenW', 'ServerLicensingSetPolicy', 
'ServerLicensingUnloadPolicy', 'ServerQueryInetConnectorInformationA', 'ServerQueryInetConnectorInformationW', 'ServerSetInternetConnectorStatus', 
'SESetAppStatus', 'SESetExecTime', 'SESetNumExecUsed', 'SeSetSecurityDescriptorInfo', 'SESetTotalExecTime', 'SetAccessSecurityDescriptor', 'SetAclInformation', 
'SetActivePwrScheme', 'SetAdapterIpAddress', 'SetClipboardData', 'SetClipboardViewer', 'SetCommMask', 'SetCommState', 'SetCommTimeouts', 'SetComputerName', 
'SetComputerNameEx', 'SetConfigurationSecurityDescriptor', 'SetConsoleCtrlHandler', 'SetConsoleCursor', 'SetConsoleDisplayMode', 'SetConsoleFont', 
'SetConsoleHardwareState', 'SetConsoleIcon', 'SetConsoleInputExeName', 'SetConsoleKeyShortcuts', 'SetConsoleMaximumWindowSize', 'SetConsoleMenuClose', 
'SetConsoleMode', 'SetConsoleNumberOfCommands', 'SetConsolePalette', 'SetConsoleTitle', 'SetCPGlobal', 'SetCurrentDirectory', 'SetDebugErrorLevel', 
'SetDefaultDllDirectories', 'SetDefaultPrinterA', 'SetDefaultPrinterW', 'SetDllDirectory', 'SetEntriesInAccessList', 'SetEntriesInAcl', 'SetEntriesInAcl', 
'SetEntriesInAuditList', 'SetEntriesInAuditList', 'SetEnvironmentVariable', 'SetErrorMode', 'SetFileApisToOEM', 'SetFileAttributes', 'SetFileSecurity', 
'SetFileTime', 'SetFirmwareEnvironmentVariable', 'SetFirmwareEnvironmentVariableEx', 'SetForegroundWindow', 'SetImageConfigInformation', 'SetIpForwardEntry', 
'SetIpNetEntry', 'SetIpTTL', 'setjmp', 'SetKernelObjectSecurity', 'SetKeyboardState', 'SetLastConsoleEventActive', 'SetLastError', 'SetLaunchSecurityDescriptor', 
'SetLocalPrimaryComputerName', 'SetMailslotInfo', 'SetMessageExtraInfo', 'SetNamedPipeHandleState', 'SetNamedSecurityInfo', 'SetNamedSecurityInfo', 
'SetNamedSecurityInfoEx', 'SetPriorityClass', 'SetPrivateObjectSecurity', 'SetPrivateObjectSecurityEx', 'SetProcessAffinityMask', 'SetProcessDEPPolicy', 
'SetProcessShutdownParameters', 'SetProcessWindowStation', 'SetRegisterLangBand', 'SetSecurityAccessMask', 'SetSecurityDescriptorControl', 
'SetSecurityDescriptorDacl', 'SetSecurityDescriptorGroup', 'SetSecurityDescriptorOwner', 'SetSecurityDescriptorRMControl', 'SetSecurityDescriptorSacl', 
'SetSecurityInfo', 'SetSecurityInfoEx', 'SetService', 'SetServiceObjectSecurity', 'SetServiceStatus', 'SetShellWindowEx', 'setsockopt', 'SetStdHandle', 
'SetStdHandleEx', 'SetSuspendState', 'SetSystemPowerState', 'SetSystemTimeAdjustment', 'SetTapeParameters', 'SetTapePosition', 'SetThreadAffinityMask', 
'SetThreadContext', 'SetThreadDesktop', 'SetThreadExecutionState', 'SetThreadLocale', 'SetThreadPriority', 'SetThreadStackGuarantee', 'SetThreadToken', 
'SetTimeZoneInformation', 'settings', 'SetTokenInformation', 'SetUnhandledExceptionFilter', 'SetupDiClassGuidsFromNameEx', 'SetupDiDestroyDeviceInfoList', 
'SetupDiEnumDeviceInfo', 'SetupDiEnumDeviceInterfaces', 'SetupDiGetClassDevs', 'SetupDiGetDeviceInterfaceDetail', 'SetupDiGetDeviceRegistryProperty', 
'SetupDiOpenDevRegKey', 'SetUserObjectInformation', 'SetUserObjectSecurity', 'SetVDMCurrentDirectories', 'SetVolumeLabel', 'SetVolumeMountPoint', 
'SetWindowCompositionAttribute', 'SetWindowLong', 'SetWindowsHook', 'SetWindowsHookEx', 'SetWindowsHookW', 'SetWindowStationUser', 'SetWinEventHook', 
'SetWinEventHook', 'SEUnProtectEnd', 'SEUnProtectStart', 'SFCDisable', 'SfcGetFiles', 'SfcGetNextProtectedFile', 'SfcIsFileProtected', 'SfcIsKeyProtected', 
'SFCScan', 'SfcTerminateWatcherThread', 'SfpVerifyFile', 'SHAnsiToUnicodeCPAlloc', 'SHAreIconsEqual', 'SHBoolSystemParametersInfo', 'SHChangeNotification_Lock', 
'SHChangeNotify', 'SHChangeNotifyDeregister', 'SHChangeNotifyDeregister', 'SHChangeNotifyRegister', 'SHCoCreateInstance', 'SHCopyKey', 'SHCreateDirectory', 
'SHCreateDirectoryExA', 'SHCreatePropertyBagOnMemory', 'SHCreatePropertyStoreOnXML', 'SHCreateStreamOnDllResourceW', 'SHCreateStreamOnModuleResourceW', 
'SHDeleteEmptyKey', 'SHDeleteKey', 'SHDeleteValue', 'ShellExecCmdLine', 'ShellExecute', 'ShellExecuteA', 'ShellExecuteEx', 'SHEmptyRecycleBin', 
'SHExpandEnvironmentStringsAlloc', 'SHFileOperation', 'SHFlushSFCache', 'SHFormatDrive', 'SHForwardContextMenuMsg', 'SHGetNoAssocIconIndex', 'SHGetSizeShared', 
'SHGetSpecialFolderLocation', 'SHGetSpecialFolderPath', 'SHGetUserDisplayName', 'SHGetUserPicturePath', 'SHGetUserPicturePathEx', 'SHHelpShortcut_RunDLL', 
'SHHelpShortcuts_RunDLL', 'SHHelpShortcuts_RunDLLA', 'SHHelpShortcuts_RunDLLW', 'SHInvokeCommandOnContextMenu', 'SHInvokeCommandOnContextMenuEx', 
'SHInvokeCommandsOnContextMenuEx', 'SHInvokeCommandWithFlagsAndSite', 'SHLoadInProc', 'ShortSizeFormatExport', 'ShowConsoleCursor', 'SHRegSetValue', 
'SHResolveUserNames', 'SHSettingsChanged', 'SHSetUserPicturePath', 'SHShouldShowWizards', 'SHTestTokenMembership', 'SHTestTokenPrivilegeW', 
'SHUnicodeToAnsiCPAlloc', 'SignerAddTimeStampResponse', 'SignerAddTimeStampResponseEx', 'SignerCreateTimeStampRequest', 'SignerFreeSignerContext', 'SignError', 
'SignerSign', 'SignerSignEx', 'SignerTimeStamp', 'SignerTimeStampEx', 'SignerTimeStampEx2', 'SizeofResource', 'Sleep', 'SleepEx', 'SNB_UserFree', 'SnmpCancelMsg', 
'SnmpCleanup', 'SnmpCleanupEx', 'SnmpClose', 'SnmpContextToStr', 'SnmpConveyAgentAddress', 'SnmpCountVbl', 'SnmpCreatePdu', 'SnmpCreateSession', 'SnmpCreateVbl', 
'SnmpDecodeMsg', 'SnmpDeleteVb', 'SnmpDuplicatePdu', 'SnmpDuplicateVbl', 'SnmpEncodeMsg', 'SnmpEntityToStr', 'SnmpFreeContext', 'SnmpFreeDescriptor', 
'SnmpFreeEntity', 'SnmpFreePdu', 'SnmpFreeVbl', 'SnmpGetLastError', 'SnmpGetPduData', 'SnmpGetRetransmitMode', 'SnmpGetRetry', 'SnmpGetTimeout', 
'SnmpGetTranslateMode', 'SnmpGetVb', 'SnmpGetVendorInfo', 'SnmpListen', 'SnmpListenEx', 'SnmpOidCompare', 'SnmpOidCopy', 'SnmpOidToStr', 'SnmpOpen', 'SnmpRecvMsg', 
'SnmpRegister', 'SnmpSendMsg', 'SnmpSetAgentAddress', 'SnmpSetPduData', 'SnmpSetPort', 'SnmpSetRetransmitMode', 'SnmpSetRetry', 'SnmpSetTimeout', 
'SnmpSetTranslateMode', 'SnmpSetVb', 'SnmpStartup', 'SnmpStartupEx', 'SnmpStrToContext', 'SnmpStrToEntity', 'SnmpStrToOid', 'socket', 'SpcGetCertFromKey', 
'SplitSymbols', 'SQLAllocConnect', 'SQLAllocEnv', 'SQLAllocHandle', 'SQLAllocHandleStd', 'SQLAllocStmt', 'SQLBindCol', 'SQLBindParam', 'SQLBindParameter', 
'SQLBrowseConnect', 'SQLBrowseConnect', 'SQLBrowseConnect', 'SQLBulkOperations', 'SQLCancel', 'SQLCancelHandle', 'SQLCloseCursor', 'SQLColAttribute', 
'SQLColumnPrivileges', 'SQLColumnPrivileges', 'SQLColumnPrivileges', 'SQLColumns', 'SQLColumns', 'SQLConfigDriver', 'SQLConfigDriver', 'SQLConnect', 'SQLConnect', 
'SQLConnect', 'SQLConnect', 'SQLCopyDesc', 'SQLCopyDesc', 'SQLCreateDataSource', 'SQLCreateDataSource', 'SQLCreateDataSourceEx', 'SQLDataSources', 'SQLDataSources', 
'SQLDisconnect', 'SQLDriverConnect', 'SQLDriverConnect', 'SQLDriverConnect', 'SQLDrivers', 'SQLDrivers', 'SQLDrivers', 'SQLDrivers', 'SQLEndTran', 'SQLEndTran', 
'SQLExecDirect', 'SQLExecDirect', 'SQLExecDirect', 'SQLExecDirect', 'SQLExecute', 'SQLExecute', 'SQLFetch', 'SQLForeignKeys', 'SQLFreeHandle', 'SQLFreeStmt', 
'SQLGetAvailableDrivers', 'SQLGetConfigMode', 'SQLGetConnectAttr', 'SQLGetConnectAttr', 'SQLGetConnectOption', 'SQLGetConnectOption', 'SQLGetConnectOption', 
'SQLGetConnectOption', 'SQLGetCursorName', 'SQLGetData', 'SQLGetData', 'SQLGetDescField', 'SQLGetDescRec', 'SQLGetFunctions', 'SQLGetFunctions', 'SQLGetInfo', 
'SQLGetInfo', 'SQLGetInstalledDrivers', 'SQLGetPrivateProfileString', 'SQLGetStmtAttr', 'SQLGetTranslator', 'SQLGetTypeInfo', 'SQLInstallDriver', 
'SQLInstallDriverEx', 'SQLInstallDriverManager', 'SQLInstallerError', 'SQLInstallODBC', 'SQLInstallTranslator', 'SQLInstallTranslatorEx', 
'SQLLoadDataSourcesListBox', 'SQLLoadDriverListBox', 'SQLManageDataSources', 'SQLMoreResults', 'SQLNativeSql', 'SQLNativeSql', 'SQLNativeSql', 'SQLNativeSql', 
'SQLNumParams', 'SQLNumResultCols', 'SQLParamData', 'SQLParamOptions', 'SQLPostInstallerError', 'SQLPrepare', 'SQLPrepare', 'SQLPrimaryKeys', 
'SQLProcedureColumns', 'SQLProcedures', 'SQLProcedures', 'SQLPutData', 'SQLReadFileDSN', 'SQLRemoveDefaultDataSource', 'SQLRemoveDriver', 'SQLRemoveDriverManager', 
'SQLRemoveDSNFromIni', 'SQLRemoveTranslator', 'SQLRowCount', 'SQLSetConfigMode', 'SQLSetConnectAttr', 'SQLSetConnectAttr', 'SQLSetConnectAttr', 
'SQLSetConnectAttr', 'SQLSetConnectOption', 'SQLSetConnectOption', 'SQLSetDescField', 'SQLSetDescField', 'SQLSetDescRec', 'SQLSetEnvAttr', 'SQLSetPos', 
'SQLSetScrollOptions', 'SQLSetStmtAttr', 'SQLSetStmtAttr', 'SQLSpecialColumns', 'SQLStatistics', 'SQLStatistics', 'SQLTablePrivileges', 'SQLTablePrivileges', 
'SQLTablePrivileges', 'SQLTables', 'SQLTables', 'SQLTransact', 'SQLTransact', 'SQLValidDSN', 'SQLWriteDSNToIni', 'SQLWriteFileDSN', 'SQLWritePrivateProfileString', 
'SRSetRestorePoint', 'StackWalk', 'StackWalk64', 'StackWalk64', 'StackWalk64', 'StartService', 'StartServiceCtrlDispatcher', 'StartTrace', 'StgCreateDocfile', 
'StgCreateDocfileOnILockBytes', 'StgCreateStorageEx', 'StgOpenAsyncDocfileOnIFillLockBytes', 'StgOpenStorage', 'StgOpenStorageOnILockBytes', 'StopWatchFlush', 
'StopWatchMode', 'StringFromGUID2', 'SuspendThread', 'SuspendThread', 'SwapMouseButton', 'SwitchDesktop', 'SwitchToFiber', 'SwitchToThisWindow', 'SwitchToThread', 
'SymCleanup', 'SymCleanup', 'SymCleanup', 'SymEnumerateSymbolsW', 'SymEnumSym', 'SymEnumSym', 'SymFromAddr', 'SymFromAddr', 'SymFromAddr', 
'SymFunctionTableAccess64', 'SymFunctionTableAccess64', 'SymFunctionTableAccess64', 'SymGetModuleBase64', 'SymGetModuleBase64', 'SymGetModuleBase64', 
'SymGetModuleInfo64', 'SymGetModuleInfoW64', 'SymGetModuleInfoW64', 'SymGetOptions', 'SymGetOptions', 'SymGetSymFromName', 'SymGetSymFromName', 'SymInitialize', 
'SymInitialize', 'SymInitialize', 'SymLoadModule64', 'SymLoadModule64', 'SymLoadModuleEx', 'SymRegisterCallback64', 'SymRegisterCallback64', 'SymSetOptions', 
'SymSetOptions', 'SymUnloadModule64', 'SymUnloadModule64', 'system', 'SystemFunction001', 'SystemFunction001', 'SystemFunction002', 'SystemFunction002', 
'SystemFunction003', 'SystemFunction003', 'SystemFunction004', 'SystemFunction004', 'SystemFunction005', 'SystemFunction005', 'SystemFunction006', 
'SystemFunction007', 'SystemFunction008', 'SystemFunction009', 'SystemFunction010', 'SystemFunction011', 'SystemFunction012', 'SystemFunction013', 
'SystemFunction014', 'SystemFunction015', 'SystemFunction016', 'SystemFunction017', 'SystemFunction018', 'SystemFunction019', 'SystemFunction020', 
'SystemFunction021', 'SystemFunction022', 'SystemFunction023', 'SystemFunction024', 'SystemFunction025', 'SystemFunction026', 'SystemFunction027', 
'SystemFunction028', 'SystemFunction028', 'SystemFunction029', 'SystemFunction029', 'SystemFunction030', 'SystemFunction031', 'SystemFunction032', 
'SystemFunction033', 'SystemFunction034', 'SystemFunction034', 'SystemFunction035', 'SystemFunction036', 'SystemFunction036', 'SystemFunction037', 
'SystemFunction038', 'SystemFunction039', 'SystemFunction040', 'SystemFunction040', 'SystemFunction041', 'SystemFunction041', 'SystemParametersInfo', 
'TerminateProcess', 'TerminateThread', 'TestingServ', 'Thread32First', 'Thread32Next', 'ThunRTMain', 'timeGetTime', 'TlsGetValue', 'TlsSetValue', 
'Toolhelp32ReadProcessMemory', 'TouchFileTimes', 'TraceReturn', 'TraceSQLCancel', 'TraceSQLConnect', 'TraceVersion', 'TransactNamedPipe', 
'TreeResetNamedSecurityInfo', 'TreeSetNamedSecurityInfo', 'TrusteeAccessToObject', 

'UDPSend', 'UnDecorateSymbolName', 'UnenableRouter', 'UnhandledExceptionFilter', 'UnhookWindowsHook', 'UnhookWindowsHookEx', 'UnhookWinEvent', 'UnloadUserProfile', 
'UnlockFile', 'UnlockFileEx', 'UnlockServiceDatabase', 'UnlockWindowStation', 'UnMapAndLoad', 'UnmapDebugInformation', 'UnmapViewOfFile', 'UnpackDDElParam', 
'UnregisterDeviceNotification', 'UnregisterGPNotification', 'UnregisterHotKey', 'UnregisterTraceGuids', 'UnRegisterTypeLib', 'UnregisterUserApiHook', 
'UpdateDebugInfoFile', 'UpdateDebugInfoFileEx', 'UpdateResource', 'UrlCreateFromPath', 'URLDownloadToFile', 'UrlEscape', 'UrlHash', 'UrlIsNoHistory', 
'UrlMkSetSessionOption', 'UrlUnescape', 'UrlZonesDetach', 'user32.FindWindow', 'UTRegister', 'UTUnRegister', 'UuidCreate', 'UuidCreateSequential', 'UuidToString', 

'ValidatePowerPolicies', 'VDMOperationStarted', 'VerifyConsoleIoHandle', 'VerifyVersionInfo', 'VerInstallFile', 'VerSetConditionMask', 'VideoForWindowsVersion', 
'VirtualAlloc', 'VirtualAllocEx', 'VirtualAllocExNuma', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualProtectEx', 'VirtualQuery', 'VirtualQueryEx', 
'VirtualUnlock', 'VkKeyScan', 'VkKeyScanEx', 

'WaitForDebugEvent', 'WaitForExplorerRestartW', 'WaitForThreadpoolTimerCallbacks', 'WaitMessage', 'WaitNamedPipe', 'WaitNamedPipe', 'WCSToMBEx', 
'WerReportSQMEvent', 'WinDetectHiddenText', 'WinExec', 'WinHelp', 'WinHttpAddRequestHeaders', 'WinHttpCloseHandle', 'WinHttpConnect', 
'WinHttpGetIEProxyConfigForCurrentUser', 'WinHttpGetProxyForUrl', 'WinHttpOpen', 'WinHttpOpenRequest', 'WinHttpQueryDataAvailable', 'WinHttpQueryHeaders', 
'WinHttpReadData', 'WinHttpReceiveResponse', 'WinHttpSendRequest', 'WinHttpSetOption', 'WinHttpSetStatusCallback', 'WinHttpWriteData', 'WinSearchChildren', 
'WinSqmAddToAverageDWORD', 'WinSqmAddToStream', 'WinSqmAddToStreamEx', 'WinSqmCheckEscalationAddToStreamEx', 'WinSqmCheckEscalationSetDWORD', 
'WinSqmCheckEscalationSetDWORD64', 'WinSqmCheckEscalationSetString', 'WinSqmCommonDatapointDelete', 'WinSqmCommonDatapointSetDWORD', 
'WinSqmCommonDatapointSetDWORD64', 'WinSqmCommonDatapointSetStreamEx', 'WinSqmCommonDatapointSetString', 'WinSqmEndSession', 'WinSqmEventEnabled', 
'WinSqmEventWrite', 'WinSqmGetEscalationRuleStatus', 'WinSqmGetInstrumentationProperty', 'WinSqmIncrementDWORD', 'WinSqmIsOptedIn', 'WinSqmIsOptedInEx', 
'WinSqmSetDWORD', 'WinSqmSetDWORD64', 'WinSqmSetEscalationInfo', 'WinSqmSetIfMaxDWORD', 'WinSqmSetIfMinDWORD', 'WinSqmSetString', 'WinSqmStartSession', 
'WinStationActivateLicense', 'WinStationAutoReconnect', 'WinStationBroadcastSystemMessage', 'WinStationCheckAccess', 'WinStationCheckLoopBack', 
'WinStationCloseServer', 'WinStationConnectA', 'WinStationConnectCallback', 'WinStationConnectEx', 'WinStationConnectW', 'WinStationDisconnect', 
'WinStationEnumerate_IndexedA', 'WinStationEnumerate_IndexedW', 'WinStationEnumerateA', 'WinStationEnumerateExW', 'WinStationEnumerateLicenses', 
'WinStationEnumerateProcesses', 'WinStationEnumerateW', 'WinStationFreeConsoleNotification', 'WinStationFreeGAPMemory', 'WinStationFreeMemory', 
'WinStationFreePropertyValue', 'WinStationFreeUserCertificates', 'WinStationFreeUserCredentials', 'WinStationGenerateLicense', 'WinStationGetAllProcesses', 
'WinStationGetAllSessionsW', 'WinStationGetConnectionProperty', 'WinStationGetDeviceId', 'WinStationGetInitialApplication', 'WinStationGetLanAdapterNameA', 
'WinStationGetLanAdapterNameW', 'WinStationGetLoggedOnCount', 'WinStationGetLoggedOnCount', 'WinStationGetMachinePolicy', 'WinStationGetProcessSid', 
'WinStationGetRestrictedLogonInfo', 'WinStationGetSessionIds', 'WinStationGetTermSrvCountersValue', 'WinStationGetUserCertificates', 
'WinStationGetUserCredentials', 'WinStationGetUserProfile', 'WinStationInstallLicense', 'WinStationIsHelpAssistantSession', 'WinStationIsSessionPermitted', 
'WinStationIsSessionRemoteable', 'WinStationNameFromLogonIdA', 'WinStationNameFromLogonIdW', 'WinStationNegotiateSession', 'WinStationNtsdDebug', 
'WinStationOpenServerA', 'WinStationOpenServerExA', 'WinStationOpenServerExW', 'WinStationOpenServerW', 'WinStationQueryAllowConcurrentConnections', 
'WinStationQueryEnforcementCore', 'WinStationQueryInformation', 'WinStationQueryInformationA', 'WinStationQueryInformationW', 'WinStationQueryLicense', 
'WinStationQueryLogonCredentialsW', 'WinStationQuerySessionVirtualIP', 'WinStationQueryUpdateRequired', 'WinStationRedirectErrorMessage', 
'WinStationRedirectLogonBeginPainting', 'WinStationRedirectLogonError', 'WinStationRedirectLogonMessage', 'WinStationRedirectLogonStatus', 
'WinStationRegisterConsoleNotification', 'WinStationRegisterConsoleNotificationEx', 'WinStationRegisterNotificationEvent', 'WinStationRemoveLicense', 
'WinStationRenameA', 'WinStationRenameW', 'WinStationReportUIResult', 'WinStationReset', 'WinStationRevertFromServicesSession', 'WinStationSendMessage', 
'WinStationSendMessageA', 'WinStationSendMessageW', 'WinStationSendWindowMessage', 'WinStationServerPing', 'WinStationSetAutologonPassword', 
'WinStationSetInformationA', 'WinStationSetInformationW', 'WinStationSetPoolCount', 'WinStationShadow', 'WinStationShadowStop', 'WinStationShutdownSystem', 
'WinStationSwitchToServicesSession', 'WinStationSystemShutdownStarted', 'WinStationSystemShutdownWait', 'WinStationTerminateProcess', 
'WinStationUnRegisterConsoleNotification', 'WinStationUnRegisterNotificationEvent', 'WinStationUserLoginAccessCheck', 'WinStationVerify', 
'WinStationVirtualOpen', 'WinStationVirtualOpenEx', 'WinStationWaitSystemEvent', 'WinTextMatchMode', 'WinTitleMatchMode', 'WinVerifyTrust', 'WinWaitDelay', 
'WlanCloseHandle', 'WlanEnumInterfaces', 'WlanGetAvailableNetworkList', 'WlanOpenHandle', 'WlanQueryInterface', 'WlxActivateUserShell', 'WlxDisconnectNotify', 
'WlxDisplayLockedNotice', 'WlxDisplaySASNotice', 'WlxDisplayStatusMessage', 'WlxGetConsoleSwitchCredentials', 'WlxGetStatusMessage', 'WlxInitialize', 
'WlxIsLockOk', 'WlxIsLogoffOk', 'WlxLoggedOnSAS', 'WlxLoggedOnSAS', 'WlxLoggedOutSAS', 'WlxLogoff', 'WlxNegotiate', 'WlxNetworkProviderLoad', 
'WlxReconnectNotify', 'WlxRemoveStatusMessage', 'WlxScreenSaverNotify', 'WlxShutdown', 'WlxStartApplication', 'WlxWkstaLockedSAS', 'WmiCloseBlock', 
'WmiFileHandleToInstanceName', 'WNetAddConnection', 'WNetAddConnection2', 'WNetAddConnection2', 'WNetAddConnection3', 'WNetCancelConnection', 
'WNetCancelConnection2', 'WNetCloseEnum', 'WNetEnumResource', 'WNetGetConnection', 'WNetGetConnection', 'WNetGetNetworkInformation', 'WNetGetProviderName', 
'WNetGetResourceInformation', 'WNetGetResourceParent', 'WNetGetUniversalName', 'WNetGetUser', 'WNetOpenEnum', 'WNetRestoreConnection', 'WNetUseConnection', 
'WNetUseConnection', 'Wow64DisableWow64FsRedirection', 'Wow64GetThreadContext', 'Wow64SetThreadContext', 'Wow64SuspendThread', 'WOWShellExecute', 
'WriteCabinetState', 'WriteConfigString', 'WriteConsole', 'WriteConsoleInput', 'WriteConsoleOutput', 'WriteConsoleOutputAttribute', 'WriteConsoleOutputCharacter', 
'WriteEncryptedFileRaw', 'WriteFile', 'WriteFileEx', 'WriteGlobalPwrPolicy', 'WriteHitLogging', 'WritePrivateProfileSection', 'WritePrivateProfileString', 
'WriteProcessMemory', 'WriteProcessorPwrScheme', 'WriteProfileSection', 'WriteProfileString', 'WritePwrScheme', 'WriteTapemark', 'ws2_32.gethostbyaddr', 
'ws2_32.getprotobyname', 'ws2_32.getservbyname', 'ws2_32.htonl', 'ws2_32.ntohl', 'ws2_32.shutdown', 'WSAAsyncGetProtoByNumber', 'WSAAsyncGetServByName', 
'WSACancelAsyncRequest', 'WSACancelBlockingCall', 'WSACleanup', 'WSADeleteSocketPeerTargetName', 'WSAGetLastError', 'WSAImpersonateSocketPeer', 
'WSAQuerySocketSecurity', 'WSARecv', 'WSARecvEx', 'WSARevertImpersonation', 'WSASetSocketPeerTargetName', 'WSAStartup', 'WSAStartup', 'WSHAddressToString', 
'WSHEnumProtocols', 'WSHGetProviderGuid', 'WSHGetSockaddrType', 'WSHGetSocketInformation', 'WSHGetWildcardSockaddr', 'WSHGetWinsockMapping', 
'WSHGetWSAProtocolInfo', 'WSHIoctl', 'WSHJoinLeaf', 'WSHNotify', 'WSHOpenSocket', 'WSHOpenSocket2', 'WSHSetSocketInformation', 'WSHStringToAddress', 
'WTHelperGetProvSignerFromChain', 'WTHelperProvDataFromStateData', 'WTSCloseServer', 'WTSConnectSession', 'WTSCreateListener', 'WTSEnumerateProcesses', 
'WTSEnumerateServers', 'WTSEnumerateServers', 'WTSEnumerateSessions', 'WTSFreeMemory', 'WTSGetActiveConsoleSessionId', 'WTSLogoffSession', 
'WTSQuerySessionInformation', 'WTSQueryUserToken', 'WTSRegisterSessionNotification', 'WTSRegisterSessionNotificationEx', 'WTSSendMessage', 
'WTSSetSessionInformation', 'WTSStartRemoteControlSession', 'WTSUnRegisterSessionNotification', 'WTSVirtualChannelOpen', 

'ZwCallbackReturn', 'ZwClose', 'ZwCreateFile', 'ZwCreateSection', 'ZwDeleteFile', 'ZwDuplicateToken', 'ZwEnumerateKey', 'ZwEnumerateKey', 'ZwFlushKey', 
'ZwMapViewOfSection', 'ZwOpenProcess', 'ZwOpenProcess', 'ZwOpenProcessToken', 'ZwProtectVirtualMemory', 'ZwQueryInformationFile', 'ZwQueryInformationProcess', 
'ZwQueryInformationThread', 'ZwQueryInformationToken', 'ZwQuerySystemInformation', 'ZwReadVirtualMemory', 'ZwRequestPort', 'ZwResumeThread', 'ZwSaveKey', 
'ZwSaveKeyEx', 'ZwSetLdtEntries', 'ZwTerminateProcess', 'ZwUnmapViewOfSection', 'ZwWriteFile', 'ZwWriteVirtualMemory']
